Digital Forensics

incident response – the process by which organization handles a date breach or cyberattack and conseqences of it 

Dig. forensics != data recovery
Dig. forensics != incident response

Digital forencis is a sum of incident response, data recovery…

You will be expert in several fields of forensics, not in every most probably. It is not possible within 45 minutes like in TV series. RAM have 32 GB nowadays. 

It can happen that the person under investigation refuses, that the file is not created by him. To prevent this, it is neccessary to compere with computer analyses (users ID…).

Hands on: 
Preparation

dd is good, but raw format is difficult to operate with:
FTK manager: https://accessdata.com/product-download

never truse forencics software, in the meaning how it works. Test multiple ones. To make it trustworth by the court

Defence exercise. Questions about the right of collecting data. The important thing was that Andrew becomes red, even thought he know the audience. It is much more difficult with unknown people. One has to provide confident solution

Gary Gessler LibraryURL https://www.garykessler.net/library/forensicsurl.html