Section 2: Forensic Fundamentals and Best Practices
In this section, we gain an understanding of filesystems, data storage and media, hard drive technologies and random access memory (RAM), and also look at common and best practices for forensic imaging and acquisition.
This part comprises the following chapters:
- Chapter 3, Understanding Filesystems and Storage Media
- Chapter 4, Incident Response and Data Acquisition