In this chapter, we won't be talking about the use of forensic write-blocking hard drive imaging devices. We won't cover any disk imaging software, too, as such tools are readily available with all major forensic suites and you most probably have spent more time with one of those tools than either author of this book. Instead, we'll discuss how to approach a Windows tablet and make it available for imaging with the tool of your choice.
Note
Note: As with smartphones and Android/iOS tablets, eMMC chips used in Windows devices can be unsoldered and placed into an eMMC reader.
This destructive method is called chip-off acquisition. Such techniques are widely covered elsewhere. In this book, we'll talk about non-destructive, software-based acquisition.
Most Windows tablets (and all Windows RT devices) come with non-removable storage in the form of eMMC chips. eMMC stands for embedded MMC, or embedded MultiMedia Card, and is closer in operation to a standard SD (Secure...