When should an examiner do a physical examination versus a ...

[berenicecastro]

When should an examiner do a physical examination versus a logical examination, or both?
 
  What will be an ideal response?

Question 2

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.
 
  Column 1 Column 2
  1. Analog A. A software mechanism that defines the way files are named, stored, organized, and accessed
  2. Architecture B. Communication channel that can provide higher speed data communication than a standard telephone circuit
  3. Broadband C. A term describing a wireless Local Area Network
  4. CDMA (Code Division Multiple Access) D. A system for determining position by comparing radio signals from several satellites
  5. File System E. A set of standard for second generation cellular networks
  6. Geolocation F. The traditional method of modulating radio signals so that they can carry information
  7. GPS (Global Positioning System) G. A custom designed program that controls the components of mobile devices and facilitates how they function
  8. GSM (Global System for Mobile Communication) H. A duplicate of data located on a mobile device
  9. Logical Extraction I. A spread spectrum technology for cellular networks
  10. Operating System J. A snapshot of the file system of a mobile device
  11. Physical Extraction K. The basic components of a mobile device
  12. SIM card L. Assessment of actual geographical location of a mobile device
  13. SD Card M. The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
  14. SMS (Short Message Service) N. A cellular network facility that allows users to send and receive text messages
  15. Wi-Fi O. Storage expansion card for a mobile device

[Shshxj]

Answer to Question 1

Answer:
Logical images are fairly fast for most devices, depending on how much memory the device has and how much of the memory is full. Physical images can take a very long time to make because on a large storage device, even if the storage is not full, the imager must look at the entire memory footprint, not just the part that has something saved to it. Based on what can be done for the particular device, the examiner should decide whether to obtain a physical or logical extraction or both. The logical extraction is fairly fast, and one may want to examine it for obvious evidence while the tool is making a physical image of the target.

Answer to Question 2

1 (491)
2 (493)
3 (491)
4 (492)
5 (498)
6 (494)
7 (494)
8 (492)
9 (495)
10 (493)
11 (495)
12 (496)
13 (494)
14 (499)
15 (491)