tag:blogger.com,1999:blog-7196788127833928948.post7391410733954687207..comments2008-07-21T14:00:31.503+02:00Comments on Information Security Short Takes: Tutorial - Computer Forensics Process for Begginne...Bozidar Spirovskihttp://www.blogger.com/profile/08748842042511112038noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-7196788127833928948.post-39773656429245477722008-07-21T14:00:00.000+02:002008-07-21T14:00:00.000+02:002008-07-21T14:00:00.000+02:00One must be very careful in collection. A friend o...One must be very careful in collection. A friend of mine actually takes photos on photographic film (not digital) of the SHA1 hash of the evidence image. Also, one must be very careful in keeping the evidence - a non-eraseable copy (CD/DVD) is very desirable, but difficult for large drivesBozidar Spirovskihttp://www.blogger.com/profile/08748842042511112038noreply@blogger.comtag:blogger.com,1999:blog-7196788127833928948.post-15325201261555009342008-07-18T02:06:00.000+02:002008-07-18T02:06:00.000+02:002008-07-18T02:06:00.000+02:00The integrity of the evidence is the most importan...The integrity of the evidence is the most important... Also, if you are doing a forensic procedure, keep a notebook containing the dates and times of what you did, and why you did what you did.. This comes in handy in court, when you are presenting your findings, and enforces the integrity of the collected evidence. Again, write down checksums!Shanehalescomputerservice.comnoreply@blogger.com