Anzeige
Erschienen in:
2024 | OriginalPaper | Buchkapitel
3. Computer Theory
verfasst von : Joakim Kävrestad, Marcus Birath, Nathan Clarke
Erschienen in: Fundamentals of Digital Forensics
Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.
Wählen Sie Textabschnitte aus um mit Künstlicher Intelligenz passenden Patente zu finden. powered by
Markieren Sie Textabschnitte, um KI-gestützt weitere passende Inhalte zu finden. powered by
Abstract
Perhaps the most important skill for someone working with computer forensics is to know how computers work. In order to locate digital traces of an e-mail, the examiner must know what such traces may look like. While this book is intended for someone who is fairly skilled in the computer world, there is theory that is extra important for a forensic examiner, and this computer theory is presented in this chapter. This includes an overview of encryption as well as a presentation of how data is represented in the digital world, in binary, hexadecimal, and plain ASCII. Further, this chapter introduces theory that is often overlooked by disciplines other than computer forensics. This includes an overview of the NTFS file system and the Windows registry—which is one of the most valuable sources of information during an examination of a Windows computer. The chapter also describes what happens when files are deleted, both from the perspective of the file system and the actual hard drive.