November 12, 2021

November 12, 2021 • Prepared for trial testimony • • • • • • Forensic examination- captures data (imaging- bit-for-bit copy), puts it through software to categorize information; huge amounts of data on computer; software helps organize to assist with review • Information stored on a hard drive in a computer; hard drive stores non-volatile data (anything saved on the drive will be on drive if you unplug it); digital device to store data • Typically knows nothing about a case when analyzes digital evidence • was shown GX 54 (has initials, case number, unique identifier on it, date) • Every piece of evidence that Uexamines gets unique bar code numbers and gets another sticker with case number, date initials, and reference to unique number on other sticker • Received GX 54 in a box with photocopy of different drive on front; led to believe was copy of drive on the front of it; had to determine how best to capture information on drive, had to see if image files or