Authors: Brian Carrier, Ph.D. (@stake)
DFRWS USA 2002
Abstract
The high-level process of digital forensics includes the acquisition of data from a source, analysis of the data and extraction of evidence, and preservation and presentation of the evidence. Previous work has been dnoe on the theory and requirements of acquisition [5] and the presevation of evidence. This paper addresses the theory and requirements of analysis and extracction of evidence from the acquired data.