#Triage

Speed Up the Digital Forensics Process

We’ve all been there, right? You’re a forensic examiner with a backlog of cases in your lab and you’ve just been handed another piece of media to add to your caseload. Of course, this is time sensitive too and the final report was needed yesterday. You want to get started with your examination right away but first you need to acquire an image of the evidence. You plug the new drive into a write-blocker and then into your forensic workstation and start the acquisition process to obtain a full forensic image you can work from.