Question: 1. What resources might investigators use when they are not technically proficient with systems containing digital evidence? Provide an example of technically-advanced resources available to an investigative agency with which you are familiar.
2. What is the process used to preserve the verifiable integrity of digital evidence? How does this process ensure that data is preserved and is not modified? How might an analyst show that the original evidence is unmodified? If you were serving on a jury, what arguments would convince you that evidence is not modified?
3. What are the major principles of risk analysis? What are the common steps in developing a risk-analysis strategy? How might these principles be applied to information-system attack or failure?
150 words minimum for each question.