Can someone please clarify what needs to be preserved in an investigation. Most cases I have been involved with include cloning a hard drive and bringing the clone back to my lab for examination. I create an image from the cloned hard drive. It is my understanding that an image of a hard drive is all that needs to be kept in order to supply defense with the files for examination . The hard drive can be wiped and reused correct?
Can someone please clarify what needs to be preserved in an investigation. Most cases I have been involved with include cloning a hard drive and bringing the clone back to my lab for examination. I create an image from the cloned hard drive. It is my understanding that an image of a hard drive is all that needs to be kept in order to supply defense with the files for examination . The hard drive can be wiped and reused correct?
Can someone please clarify what needs to be preserved in an investigation. Most cases I have been involved with include cloning a hard drive and bringing the clone back to my lab for examination. I create an image from the cloned hard drive. It is my understanding that an image of a hard drive is all that needs to be kept in order to supply defense with the files for examination . The hard drive can be wiped and reused correct?
I'd say that as long as you had the original evidence drive preserved somewhere and the hash of the original matches the hash of the image, you're good to go. The key being that you can prove that the image is an exact duplicate of the original.