Summary

Imaging a device is one of the primary steps to ensure that the data on the device is not modified. Once the device is accessible, an examiner can extract the data using manual, logical, or physical data extraction techniques. Logical techniques extract the data by accessing the file system. While the physical techniques access a larger set of data, they are complex and require great expertise to perform. Manual extraction should be performed to validate data or only when one tool is used to create the image. Once the data is acquired, examination and manual extraction follows, as described in the next chapter.