Post-Genesis Digital Forensics Investigation

Running head: COLLECTION AND ACQUISITION
Collection and Acquisition
Name of the Student
Name of the University
Author Note

COLLECTION AND ACQUISITION
1
Description of the Method:
In this aspect the chosen method is the collection and acquisition. In the aspect of
digital forensic collection and acquisition are two individual process used for the gathering of
digital evidence. The collection process is executed after the identification of the digital
evidence. In this aspect, all the digital devices are transferred to the laboratory or some
equivalent place for the analysis purpose (Quick and Choo 2016). After the collection
process, the acquisition process is executed. Acquisition is the process of extracting the
digital evidence from the electronic media (Ramadhani et al. 2017). There are total four
methods in which data acquisition can be performed. The first one is the disk to disk copy.
The other methods are the logical disk to disk file, disk to image file and sparse data copy of
a folder or file. The sparse data acquisition can be useful for some specific type of situation
where too much data needs to be acquired from the large drives or the RAID drives. The
examiner needs to comply with the “Order of Volatility” during collection of digital
evidence.
Reflection on Experience:
I have personally performed the data collection and the data acquisition and from my
personal point of view these processes are quite easy to follow. In this aspect, collection of
the data was the easiest part for me. The next part in this process was the data acquisition. As
discussed in above there are total four methods through which data acquisition can be
performed. For me, three of the four methods were very easy to perform. Only I have faced
some difficulty during the sparse data copy especially when it performed over the raid
drivers. So, my point of view forensic acquisition of the RAIDs can be a bit difficult for the
data investigators. Also, during collection of data it was mandatory that I must comply with
the rule of “Order of Volatility”. From my personal evaluation I have assessed that every