Many a long hour has been spent with a disk editor going through each sector of the original disk, only to be met at the end of the day with the allegation the investigator has somehow tampered with the original media. Whilst it seems to be common sense, it is surprising how many people do not realise the consequences of just booting a PC under its own operating system. This is where taking an image , and working solely on that image, preserves the data in its original form. The adaptation of imaging to the investigation of magnetic media, together with the appropriate software, now allows the Forensic Computer Examiner free range to all of the data on a disk without fear of corrupting the original. The untrained or inexperienced user will fall into traps and cause problems perhaps even invalidating any evidential data found.
Today there are accepted guidelines for good practice.
Vogon International Limited. All rights reserved.