Computer Forensics

Copyright Priscilla Oppenheimer

Week 7: Preserving and Recovering Digital Evidence

Disk imaging

Creating a message digest or hash code for a disk

Where data hides; deleted and erased data

File systems

Files

Modify Access Create (MAC) dates to establish time line

File headers - info about file type

More WinHex