©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Chapter 07 Handling a Digital Crime Scene ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.

Figure 1.1 FIGURE 7.1 Relationship between physical and digital crime scenes. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

FIGURE 7.2 Tableau hardware duplicator used to acquire evidence from hard drives. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 7.3 Photograph of a Windows mobile device with a scale showing all modes of network communication have been disabled in order to isolate the device. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 7.4 Sketch of multiple servers mounted on a rack. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 7.5 Remote forensic tool used to acquire digital evidence from a computer over the network. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 7.6 FTK Imager Lite running on a live computer to acquire an encrypted volume. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.

Figure 1.1 FIGURE 7.7 An overview of the decision process when preserving a computer. ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Copyright © 2011 Academic Press Inc.