7-43.2 Forensic Examination Flashcards
1
Q
Bit by bit copy of source material that preserves all latent data
A
Bit stream image
2
Q
Process of “Dumping RAM”
A
Memory Imaging
3
Q
Tool used to intercept inadvertent drive writes
A
Write Blocker
4
Q
Space between the end of a file and the end of the cluster
A
Slack Space
5
Q
Data about data
A
Metadata
