Title: Data Acquisition
Course: CAP 2140 Digital Forensics > Section: Data Acquisition

Introduction

To preserve digital evidence, data needs to be acquired by "static acquisition." Many times you have only one chance to create a reliable copy of disk evidence with data acquisition tool. Therefore learning how to use these tools well is crucial, and you must take steps to make sure you acquire an image that can be verified.

Objectives

At the end of this module the student will be able to:

- List digital evidence storage formats
- Explain ways to determine the best acquisition method
- Describe contingency planning for data acquisitions
- Explain how to use acquisition tools
- Explain how to validate data acquisitions
- Describe RAID acquisition methods

Readings and Resources

- Textbook: Chapter 4 pg. 99-140
- How and when to use the dd command?: http://www.codecoffee.com/tipsforlinux/articles/036.html
- SHA hash functions: http://en.wikipedia.org/wiki/SHA-1