Problem
Case Study: Digital Forensics and Indicator Analysis Techniques
a) Which four phases outline the procedures involved in a forensics investigation?
b) Why might a forensics investigator need to be hired on a work product retention basis?
c) To preserve evidence of a temporary file system mounted to a host, which system device must you target for evidence collection?