The document outlines the digital forensics process, which includes seizure, examination, analysis, and reporting. It distinguishes between logical and physical copies of data, emphasizing the importance of forensic imaging for preserving evidence. Additionally, it mentions the need to utilize search terms to locate relevant data within the last six months on a hard drive.

1. The Digital Forensics Process
Seizure
examination
analysis
reporting

2. Digital Fingerprint

3. Logical Copy vs. Physical
Copy
 A normal “copy” of a hard drive.
 A forensic image/bitstream copy

4. Getting to the evidence
All Data
on the HD

5. Getting to the evidence
All Data
on the HD
Search
Terms

6. Getting to the evidence
Dated w/in last 6
months
All Data
on the HD
Search
Terms