Retrieving a forensically-sound file is not the same as taking an image of a hard drive. A hard drive image collects everything on a hard drive — including deleted data — while collecting a forensically-sound file targets the file sought. Although recovering a file directly is easy, it doesn’t gather the same information as traditional digital forensic practice. But, what are organizations leaving aside in their pursuit of efficiency and lower costs?
DFI News continues its discussion with Sarah Thompson, Senior Product Manager at cloud-hosted ediscovery software company Zapproved, Inc. We tried to find out if digital forensic and incident response practitioners should be afraid for their jobs. Sarah explained the differences and similarities of the collection done by her company’s Software-as-a-Service (SaaS) and forensic data gathering.
Read part 2 of the DFI News interview of Zapproved’s Sarah Thompson.