Computer Systems

As we discussed in previous chapters, digital forensic investigators must control the environment they operate in. The diversity of computer hardware, operating systems, and filesystems requires the digital forensic investigator to have a firm understanding of all the different and potential configurations they may encounter. This requires the digital forensic investigator to have procedures or controls to protect the integrity of digital evidence and the processes used to examine it. If you do not understand the boot process and how the system reacts when it starts or which filesystem is used on storage devices, you could make a fatal mistake. In addition, you must understand how they work together. Failure to understand these essential components could lead you to alter the digital evidence. You will also find that you will be less effective when you testify in judicial or administrative proceedings.

In this chapter, we will cover the following topics:

...