Discussions

Discussion 1: Data Acquisition and RAID

• Describe at least three challenges of performing data acquisition on a device using a RAID (Redundant Array of Independent Disks) disk configuration. Determine whether or not you believe any one RAID configuration presents more challenges than the others and provide justification.

• From the e-Activity, thoroughly describe the RAID data acquisition forensics tool you researched, including at a minimum its functions, advantages / disadvantages, and cost. Explain why you would consider utilizing this tool as a system forensics specialist, and provide a scenario where this tool would assist you in an investigation.

E-Activity:Use the Internet to research and select at least one forensics tool that aids a forensic specialist in RAID data acquisition.

Discussion 2: Live System Forensics

• Explain in your own words why there is a need for live system forensics and discuss how this type of analysis improves on static system forensics analysis. Describe the challenges with data consistency and why this is an area of concern for system forensics specialists.

• Analyze the four acquisition methods to determine whether or not these methods are suitable for live data acquisition. Outline the process you would take to determine the best acquisition method for live system analysis.

Discussion 3: Incident and Crime Scene Procedures

• Compare and contrast collecting evidence at a private-sector incident scene and processing a law enforcement crime scene. Compare the differences and similarities of evidence seizure and storage procedures for these two types of investigations.

• Determine the purpose of creating a digital hash. Explain in detail the need for this procedure and the potential damage if this critical step is not taken.

Discussion 4: Virtual Machine Forensics.

• Determine what you perceive to be the greatest challenge when dealing with virtual machines from a system forensics perspective. Provide a rationale with your response.

• From the e-Activity, determine how virtual machines can be used as both useful forensic tools and tools to thwart forensic investigations. Decide which of these two uses of virtual machines you perceive is more common and justify your answer.

E-Activity:Go to the Forensic Focus Website to read the article titled "Virtual Forensics: A Discussion of Virtual Machines Related to Forensics Analysis".