Electronic Discovery Unit 2, Essay Example

Forensic investigators use a platform that is called as dedicated forensic system. The purpose of this platform is to accommodate hard drive connections, as it is specially designed and constructed for that purpose. In order to copy data from the hard drive, an investigator connects two hard drives altogether to the dedicated forensic system i.e. source hard drive and blank hard drive (Forensic data handling, n.d ). After connected the hard drives, investigators deploy specialized imaging software that enables them to transfer bit level information from the source hard drive to the blank hard drive.

After copying all the files to the blank hard drive, a source hard drive is detached from the system. Moreover, one more system is used known as ‘original system imaging’. This technique is only applicable it there is no possibility of removing the source hard drive from the system, however, there is a requirement of connecting a blank drive within the system, in order to create images of the data (Forensic data handling, n.d ).

Furthermore, one more technique known as ‘system to system imaging’ utilize two separate workstations i.e. source workstation and investigators workstation. That can also be called as forensic imaging system. This method is useful when there are incompatibility issues with the current hard drives, For example, SCSI and IDE. In addition, images that are stored from the source hard drive are copied on CD/DVD disk, as they are considered the safest way (Forensic data handling, n.d).

As far as legal issues are concerned, data that is collected for forensic purpose must be kept in a secure environment. Moreover, logs related to the stored data must be maintained by the data owners and authorized organizations, as they can be used for legal issues (Forensic data handling, n.d).

References

Forensic data handling, n.d Retrieved 10/8/2011, 2011, from http://www.bizforum.org/whitepapers/cybertrust-1.htm