Revision as of 04:37, 22 September 2017 edit Poppenhe (talk \| contribs) 184 edits m →Acquisition ← Previous edit		Revision as of 07:35, 22 March 2018 edit undo Chevy99 (talk \| contribs) 32 edits m Updated acquisition with reference to a more recent approach. Tag: Visual edit Next edit →
Line 43: The acquired image is verified by using the [[SHA-1]] or [[MD5]] [[cryptographic hash function\|hash function]]s. At critical points throughout the analysis, the media is verified again to ensure that the evidence is still in its original state. The process of verifying the image with a hash function is called "hashing." Given the problems associated with imaging large drives, multiple networked computers, file servers that cannot be shut down and cloud resources new techniques have been developed that combine digital forensic acquisition and ediscovery [https://patents.google.com/patent/US8392706 processes]. ==Analysis==

Digital forensic process: Difference between revisions