I. Background of Digital Forensic (cont'd)
- Acquisition and Forensic Imaging / Data Collection
After seizure, the digital media will be duplicated with a write blocking device, which creates a forensic duplication. The original digital media is then securely stored to prevent tampering.
In some case the original digital data is directly collected and examined on the digital media without duplication.
- Analysis of Digital Media
The contents of the image files are analysed by forensic examiners with specialised tools, such as Guidance EnCase and Sleuth Kit ("TSK"), to identify evidence.
This is the final stage after analysis of the digital media to convert data into a form which is suitable for non-technical individuals to become evidence in court. A "digital forensic report" should be compiled to include the following information: