This discussion contains two parts. Please ensure that you address each of the points in each part. Part 1 - Discuss the implications of full volume encryption and what forensic examiners must be mindful of when dealing with such technology on a "live machine" or one that is powered off. Discuss the difference between imaging the physical disk versus a volume. When imaging a "live machine," are their differences between imaging the physical disk v. logical volume in terms of being able to view logical data within the forensic image in your forensic software? Part 2 - Assume that you have just arrived at the scene of a search warrant, and you have been asked by the investigator to assess a Windows Surface device, which is running Windows 8 Enterprise. The user account screen is in a locked state, and the desktop is obviously not in view.
![[object Object]](/_next/image/?url=%2F_next%2Fstatic%2Fmedia%2Flogo.6d15ce61.png&w=640&q=75){kind=small}
![[object Object]](/_next/static/media/star-bottom.7253800d.svg)
