IT principles in digital investigation 2

As the lead for a digital forensics team you are now being asked by the forensics manager to give a training session on how to acquire digital evidence. The session must be given to your junior forensics team. In this training session, you will need to demonstrate how to acquire digital evidence without causing alteration through the use of both hardware and software write blocking and the preferred technology for this write blocking. In addition, the training must demonstrate how investigators perform detailed analysis of the evidence collected from formatted media, deleted files, allocated space, swap space, slack space, encrypted space, and unallocated space. These two demonstration areas are the most critical steps for junior investigators if they are to both completely understand the evidence acquisition process and places where suspect data may hide on formatted media.Provide the following in a 5–7 slide PowerPoint presentation:A title slideAn introduction to the contents of the reportDetailed demonstration of how to acquire digital evidence without causing alteration through the use of both hardware and software write blocking—and the preferred technology for this write blockingDemonstrate how investigators perform detailed analysis of the evidence collected from formatted media, deleted files, allocated space, swap space, slack space, encrypted space, and unallocated spaceA conclusion for the digital evidence acquisition and write blocking processA reference slide with sources properly cited in APA styleThe presentation should be a minimum of 5–7 PowerPoint slides in length including speaker’s notes (250 words minimum), not including the title and reference slides and neatly formatted.