Title: 2. Determining the Best Acquisition Method
Course: IN 2005 Digital Forensics > Section: Module 4: Chapter 4 - Data Acquisition

Determining the Best Acquisition Method

1. Two types of data acquisition:
  - Static acquisition
  - Live acquisition
2. Four different methods for acquiring data:
  - Bit-stream disk-to-image file copy
  - Bit-stream disk-to-disk copy
  - Logical disk-to-disk or disk-to-disk data
  - Sparse data copy
3. Some of the main considerations when acquiring evidence data, including:
  - Size of the source disk (explain compression methods)
  - When working with large drives, an alternative is using tape backup systems
  - Whether or not you can retain the suspect’s disk