Chapter 17 COMPUTER FORENSICS.pptVIP

Chapter 17COMPUTER FORENSICS Introduction Computers have permeated society and are used in countless ways with innumerable applications. Similarly, the role of electronic data in investigative work has realized exponential growth in the last decade. The usage of computers and other electronic data storage devices leaves the footprints and data trails of their users. Introduction Computer forensics involves the preservation, acquisition, extraction, and interpretation of computer data. In today’s world of technology, many devices are capable of storing data and could thus be grouped into the field of computer forensics. The Basics Before getting into the nuts and bolts of computers, the important distinction between hardware and software must be established. Hardware comprises the physical and tangible components of the computer. Software conversely, is a set of instructions compiled into a program that performs a particular task. Software are those programs and applications that carry out a set of instructions on the hardware. Terminology Computer Case/Chassis: This is the physical box holding the fixed internal computer components in place. Power Supply: PC’s power supply converts the power it gets from the wall outlet to a useable format for the computer and its components. Motherboard: The main circuit board contained within a computer (or other electronic devices) is referred to as the motherboard. System Bus: Contained on the motherboard, the system bus is a vast complex network of wires that serves to carry data from one hardware device to another. Terminology Read Only Memory (ROM): ROM chips store programs called firmware, used to start the boot process and configure a computer’s components. Random Access Memory (RAM): RAM serves to take the burden off of the computer’s processor and Hard Disk Drive (HDD). The computer, aware that it may need certain data at a moments notice, stores the data in RAM. RAM is referred to as volatile memory