The identified storage objects include: floppy disk, hard disk, U disk, ZIP disk, JAZ disk, magnetic tape, magneto-optical disk, CDROM, CDRW, DVD, MO, CF card, MS card, SD card, MMC card, network hard disk, e-mail, etc.
The functional identification of software and programs includes whether it is pirated software and whether there is software infringement. The evaluation file formats include spreadsheets, Word documents, databases, text files, log files, emails, pictures, video files, sound files, exchange files, temporary files, etc.
General methods of data forensic identification:
1, specialized data replication, recovery and reproduction: Most computer systems have the function of automatically generating backup data, recovering data and redundant data, and some important database security systems also prepare special backups for databases. These systems are generally composed of special equipment and special operation management programs, which are generally difficult to tamper with. Therefore, when a computer crime occurs, the relevant evidence has been modified or destroyed, and we can compare and recover the automatically backed-up data with the processed data evidence to obtain the evidence needed for the final case. Available tools include efficiency source data compass, Flash data recovery master, data replication king, etc.
2. Maintain data integrity, authentication and reproducibility. The whole process of data appraisal is supervised, and all the investigation and evidence collection work done by the appraiser must be supervised by experts appointed by other parties. The results or conclusions of any forensic analysis can be copied by another appraiser.