6. The BIOS will, based on configuration, attempt to read and load into local registers as well as physical memory the boot loader section of a boot device, such as a hard disk, floppy, or bootable optical media in many of today’s devices. Some of today’s newer systems will also provide boot capability from devices such as USB (Universal Serial [ Read More ]
Following along the airport analogy once again, the investigator may observe, note, collect witnesses, collect videotape, and then isolate the scene and collect the remaining physical evidence. In a standard PC, volatile information can be found in several places other than the RAM.
This limited definition occurs partly because most computer forensics investigators think of a hard disk as being a static device that is collected in an “at rest” state or offline from an active operating system.
In the early days of computer forensics investigations in the criminal arena, investigators focused heavily on computer systems’ hard disks. Today, a great deal of emphasis is still placed on the physical hard disk storage devices because of their static nature.
WLANs, especially unsecured WLANs, can introduce the possibility of challenges ...