Week 3 - Storage Devices Flashcards
What are some examples of storage media?
Hard Disks (HDD/SSD) Removable Drives External Disks USB thumb drives CD, DVD, Blu-ray disks
Where specifially is digital evidence found?
On storage media.
What is the problem with finding USB devices?
Because USB devices are small and can be easily disguised as other objects, it can be hard to recognise them during investigations. The could be hiiden as toy cars, or have a cap over the USB interface.
What is more common, internal or external disks?
Internal disks.
What is an external disk?
An external drive that can be connected up to a computer using a USB cable or other cable. They are external to the actual device.
What makes CDs, DVDs, and Blu-rays harder to collect as evidence?
They are not typically thought of as evidence, and people could have many of these disks which makes it hard to go through each one to search for evidence.
What are the different ways of storing data on storage media?
Volatile data
Non-Volatile data
What is volatile data?
Data that is only storage when the device has power, and is lost when the device powers off.
What is volatile data?
Data that is only storage when the device has power, and is lost when the device powers off. Normally only RAM stores volatile data.
Is data more commonly volatile or non-volatile?
Non-volatile
What are some other ways of storage?
The Cloud
Networking
TRUE OR FALSE: Evidence only found on the suspects computer.
FALSE, evidence can be found in external storage, like USBs or the Cloud.
What are some issues associated with the data evidence on storage devices?
Data corruption
Loss of data
Interference or tampering
Errors in the interpretation and analysis of the data
What is something that an investigator must consider when they find digital evidence?
The evidence should not be explicitly trusted off the bat. It may be disingenuous, or corrupted. The investigator must comfirm the integrity of the data that is used as evidence.
What is something that an investigator must consider when they find digital evidence?
The data should not be explicitly trusted off the bat. It may be disingenuous, corrupted or tampered with. The investigator must comfirm the integrity of the data that is used as evidence.
