2.2.3. Event Reconstruction Techniques

  • Requires knowledge about OS and applications
  • Aim of this phase is to create a hypothesis with supportive files, evidences etc 

at

2.3.2 Essential & Non-essential data

  • 1.1.3.3 Types of Sector Addresses
    Physical address is address of the sector with respect to start of physical media. One way of addressing was to mentioning plate number , tr...
  • 1.1.2.1 CPU & Machine Codes
    CPU Central processing unit or processor. Can process assigned job. but cant create job for itself. OS assigns job to CPU. CPU picks up inst...
  • 1.1.1.3 Strings and Encoding
    How computer stores sentence ? Computer does not know characters and symbols. Computer has a unique numerical value for a symbol. Computer k...