Forensic data analysis: Difference between revisions

Revision as of 15:59, 14 February 2013

Revision as of 08:14, 15 March 2013

Line 6:

== Methodology ==

The analysis of large volumes of data is typically performed in a separate database system run by the analysis team. Live systems are usually not dimensioned to run extensive individual analysis without affecting the regular users. On the therother hand, it is methodically preferable to analyze data copies on separate systems and protect the analysis teams against the accusation of altering original data.

Due to the nature of the data the analysis focusses more often on the content of data then on the database it is contained in. If the database itself is of interest then [[Database forensics]] are applied.