1. Imaging to Evidence Containers Using Encase or FTK There is a debate within the digital forensics community as to which is a more trustworthy method for acquiring and storing a bit-for-bit copy of the evidence media: (a) making a bit-for-bit copy of the source media onto forensically sterile media or (b) imaging to a forensic container file on a disk that contains other files (using a forensic tool such as FTK or Encase). Research the issue and write a short explanation that you could use to prepare yourself to answer a defense attorney's questions of you as an expert witness.
2: Access Data Certified Examiner Before responding to this question, review the following:
AccessData Certified Examiner®(ACE®)certification accessdata.com/training/computer-forensics/certification AccessData Certified Examiner® (ACE®) Study Guide https://ad-pdf.dsd5zvtm8ll6.cloudfront.net/ACE%20Study%20Guide%20Aug%202013.pdf Explain why this certification is valuable for forensic examiners. Will you pursue this certification after taking this course? Why or why not?
3: Certified Computer Examiner (CCE) Certification Before responding to this question, review the following:
CCE Certification Competencies
www.isfce.com/policies/CCE%20Certification%20Competencies.pdf
•CCE Testing Process www.isfce.com/process.htm Explain why this certification is valuable for forensic examiners. Will you pursue this certification after taking this course? Why or why not?
4: Remote Acquisition of Forensic Images Read James Wiebe's discussion of remote acquisition of forensic images using the Tableau product. www.dfinews.com/articles/2014/03/product-insight-remote-forensic-acquisition-using-hardware-tools