| Slideshow ^ |< << Slide 2 of 22 >> >| |
1. My aims
Why do I have to start a pc?
EnCase, FTK, etc. show only data and hex-code
- Examine the look and feel
- Interactive, user-level perspective of the environment
- Non-standard programs (bookkeeping, etc.)
Forensically correct:
- Clone harddisk
- Virtualization of forensic images