Before looking in any detail at digital evidence and the intriguing processes of its location, recovery, and analysis, it is helpful to understand the fundamentals of computer devices and how they store digital information. Doing so will provide a sound basis for understanding the nature of digital evidence and its value to the practitioner. The nature of digital evidence will be touched upon in this chapter but will be described in greater detail in Chapter 3, The Nature and Special Properties of Digital Evidence.
This chapter will describe and explain the basic workings of computer hardware and the operating systems and applications typically installed on them. It will describe how these environments are used to create, store, and transfer electronic data. An insight is provided into the workings of computers and storage devices and the location of datasets where digital evidence may be located.
The topics covered in this chapter will:
Detail...