Home > Articles > Security > Network Security

  • Print
  • + Share This
This chapter is from the book

Chapter Review

  1. In what ways does Casey’s six-step model differ from the earlier four-step models of digital investigation? What is new, and what has changed?
  2. Where in the Casey model would one begin to ascertain precisely what legal documentation would be required for a particular investigation?
  3. Is Zubulake v. UBS Warburg more relevant to a criminal case or a civil matter? Explain your answer.
  4. Discuss the difference between procedural documentation and process documentation. In which document would you explain what steps you took during the examination of a file system?
  5. During the process of examination, you have reason to suspect that files that were deleted may still exist. What is the process for locating intact files in unallocated disk space?
  • + Share This
  • 🔖 Save To Your Account