Ice-Crown.com

6. The BIOS will, based on configuration, attempt to read and load into local registers as well as physical memory the boot loader section of a boot device, such as a hard disk, floppy, or bootable optical media in many of today’s devices. Some of today’s newer systems will also provide boot capability from devices such as USB (Universal Serial  [ Read More ]

Following along the airport analogy once again, the investigator may observe, note, collect witnesses, collect videotape, and then isolate the scene and collect the remaining physical evidence. In a standard PC, volatile information can be found in several places other than the RAM.

This limited definition occurs partly because most computer forensics investigators think of a hard disk as being a static device that is collected in an “at rest” state or offline from an active operating system.

In the early days of computer forensics investigations in the criminal arena, investigators focused heavily on computer systems’ hard disks. Today, a great deal of emphasis is still placed on the physical hard disk storage devices because of their static nature.

Twisted-pair is generally good only for a maximum segment length of 100 meters (328 feet). Sometimes investigators will hear twisted-pair referred to by its EIA/TIA rating, such as CAT 5 for category 5.

Each networking topology can use different types of cabling. Although other factors can contribute to the selection, the type of cabling utilized in a given topology is usually based on the required communications speed and range between stations. Bus topologies use coaxial cable, commonly referred to as thinnet or thicknet.