20. computer media examination

• What is the most critical stage of any media examination?

  • Imaging, or creating the forensically correct bit-by-bit copy of the evidence medium, is the single most critical part of the exam

  • It is the single part of the exam that puts the original evidence most at risk

  • This is the only stage of the process where the evidence medium is attached to a computer.

  • Therefore, in this step evidentiary data might be lost due to a hardware malfunction or examiner/operator error.

  • For example, examiner accidentally formats the evidence drive rather than the brand new drive intended for forensic copy of the image.

  • While imaging is acutely important, chain of custody and proper storage are the most important long-term steps.