Data Collection Procedures

Question 1

What is Data Acquisition?

Answer 1

method and tools used to create forensically sound copy of the data from a source device, such as system memory or hard disk.

Question 2

What to collect as evidence?

Answer 2

1. CPU registers and cache memory
2. system memory, routing tables, ARP caches, process tables, temporary swap files
3. Data on persistent mass storage (HDD/SDD/flash drive
4. Remote logging and monitoring data
5. Physical configuration and network topology
6. Archival Media