Part I – Essay Questions
1. Is it necessary for forensic examiners to understand how data is stored by various types of file systems? Explain why or why not. Support your answer with examples.
2. When examining evidence media, is it necessary to use the same operating system used on the original? Explain why or why not. Support your answer with examples.
3. Is the date-time stamp of various file system objects significant in the analysis of evidentiary media? Explain why or why not. Support your answer with examples.
Part II – Scenario
You are the digital forensic examiner at a pre-trial session with the judge and opposing counsel. You have been asked to explain the various methods that data is stored and erased in the Windows environment. Your discussion should include concepts such as slack space, unallocated space, the sequence of events that take place when a file is deleted, and any other points that you deem important. Keep in mind that you must prepare your discussion in terms that non-technical people can understand.
Must be 3-5 pages