Questions:

(1) For the general preparation, we need to know physical analysis and logical analysis. Describe each analysis definition and processing steps   

(2) Working with forensics, you need to be familiar with a variety of storage formats. Discuss various storage formats and explores issues with storage formats.

Grading Rubric for Discussion Forum 2

• Providing a comprehensive discussion of the topic: 25 percent
• Justifying ideas and responses by using appropriate examples and references from texts, Web sites, other references, or personal experience and cited the sources in the correct: 25 percent
• Commented on at least two of your classmates’ postings in a meaningful way (at least 100 words): 25 percent
• Filling the number of required at least 200 words or more for the discussion: 25 percent

You should be actively engaging with weekly discussions by providing peer-to-peer feedback. You need to make at least two comments on the responses posted by your classmates. You should be writing your response/feedback/comments/question at least two students in your class. This is to see your performance in online discussion.

computer sciencediscussion board

Week 3 Discussion: Collecting, Seizing, and Protecting Evidence

In Discussion Forum 2, post your response to the following discussion topic. Reply to

at least two classmates’ responses and shares informative URLs by the date indicated in the Course Calendar. Each student posts their discussion assignments in Word Format into the Week 3 Discussion #2.

Questions:

(1) For the general preparation, we need to know physical analysis and logical analysis. Describe each analysis definition and processing steps   

(2) Working with forensics, you need to be familiar with a variety of storage formats. Discuss various storage formats and explores issues with storage formats.

Grading Rubric for Discussion Forum 2

· Providing a comprehensive discussion of the topic: 25 percent

· Justifying ideas and responses by using appropriate examples and references from texts, Web sites, other references, or personal experience and cited the sources in the correct: 25 percent

· Commented on at least two of your classmates’ postings in a meaningful way (at least 100 words): 25 percent

· Filling the number of required at least 200 words or more for the discussion: 25 percent

You should be actively engaging with weekly discussions by providing peer-to-peer feedback. You need to make at least two comments on the responses posted by your classmates. You should be writing your response/feedback/comments/question at least two students in your class. This is to see your performance in online discussion.

1. Physical Analysis is an offline analysis performed on a disk or a forensic duplicate. It is used to gather data such as URLs and email addresses. When doing a Physical Analysis you should also index the file formats of the data that is found. Depending on the case that you are investigating will determine how the files are sorted. Data can be stored in a variety of file types. Images are typically stored as JPEG or PNG file types. Videos can be stored as MKV, MP4 and many more. There are environments in the computer that must be physically analyzed such as the swap file and any unallocated space that might hide critical data that the user was unaware of.

Logical Analysis is when you use the operating system to carefully read through the data. Logical analysis is used to determine what the user was doing with their computer. This information is then used to create a timeline.

2. There are a variety of storage formats that computers owners use to store data. Each poses its own set of issues for investigators performing analyses on the device.

a. Magnetic Media – Can be destroyed by the use of magnets.

b. Solid-State Drives – Data can be hidden and protected.

c. Digital Audio Tape Drives – Can be worn out over time due to use.

d. Digital Linear Tape and Super – Can be worn out over time due to use.

e. Optical Media – Discs can become damaged easily.

f. USB Drives – Can be easily erased or overwritten.

less

Digital Forensic is a part of forensic that focuses on investigating and recovering digital evidence found on digital devices. This type of investigation requires analyzing information, devices, and machines. Such analysis is important to figure out and collect evidence. The type of analysis which deals with hard drive structures and file formats are physical analysis and logical analysis. Physical analysis is an analysis conducted on evidence that has already been retrieved on a disk or as a forensic duplicate. It is conducted to recheck things that might have been overlooked or was invisible. Similarly, logical analysis is also an analysis, conducted on evidence that has already been retrieved on a disk or as a forensic duplicate, however, the logical analysis looks for things that are known about or visible and it is done using the native operating system to pursue the data. 

The processing steps for physical analysis are at first checking for a list of URLs and email address on computers. If any of the lists are deleted it can be retrieved using software and tools Like Encase. The other step is to identify the different types of file formats as there are different file formats for different cases. Once it is identified measures can be used to analyze and recover data from it. The next step would be to check swap files as many information could be retrieved from it. However, if swap files are temporary it releases files to unlocated spaces, so as a further step examining unlocated spaces is also a must. The processing step of logical analysis is to first divide data on hard drives into layers. Later evidence is to be checked on each layer individually. This helps to check data independent of one another. 

2.

The types of storage format and issues related to it are listed below.

1. Magnetic media- It is a type of storage format used in computers. Hard disk drives and floppy drives are examples of magnetic media. In magnetic media, data are organized in tracks around the platter. The issues related to magnetic media are any interference of magnets demagnetizes the device. So it is sensitive to magnetics. Additionally, It has moving parts so it has to be handled with care; Dropping it may damage the data. 

2. Solid-state drive- it is a type of storage format which uses microchips. It can retain memory without using any power. Unlike magnetic media, it is less likely to be physically damaged, requires less power and starts time is faster too. The issues related to solid-state drive are it is expensive compared to magnetic media and even has low capacity. The other downside to it is it can only be used in small devices like tablets.

3. Digital audio tape drive- It is an old-fashioned storage format and it is similar to audiotapes. It looks like a magnetic tape closed inside a protective cover made of plastic, its main aim is to record data and the use of this drive is very common. It contains archived/ back up data so while doing a forensic test checking backups is also in must. The issues related to digital audio tape drive are they wear out after a certain time and will be no longer usable. Also, it can be replaced periodically. 

4. Digital liner tape and super DLT- it is similar to digital audio tape but it relies more on linear recording methods. 

5. Optical Media- Type of storage in which data is written in red with a laser. The examples of optical media are CDs and DVDs. The issues related to it or any scratch could be problematic for using it any further as it could damage the data. Also, it has limited storage as it can hold up to 25 to 150 GB only. 

6. USB- It is a storage type with connectivity technology. It is a small drive that is connected externally to any other device or hard drives. Pendrive, thumb drive are the types of USB. The issue related to USBs are it can easily be erased or overwritten.