is now LinkedIn Learning!

To access courses again, please join LinkedIn Learning

All the same content you know and love

Plus, personalized course recommendations tailored just for you

Get LinkedIn Premium features to contact recruiters or stand out for jobs

Try LinkedIn Learning for free
Questions? Visit our help center.
Skip navigation

Remote acquisition

Remote acquisition: Learning Computer Forensics (2014)
Remote acquisition: Learning Computer Forensics (2014)

Join for an in-depth discussion in this video Remote acquisition, part of Learning Computer Forensics (2014).

Resume Transcript Auto-Scroll
Skill Level Intermediate
1h 57m
Show More Show Less

Q: Which operating systems support built-in write blocking?

A: Microsoft introduced the registry concept into its OS with the release of Windows 95. As a result, registry-based write blocking has been available since then. In this course, we tested registry-based write blocking on both Windows 7 and Windows 8.
If for whatever reason your OS doesn’t support registry-based write blocking, you can enable software-based write blocking via a forensics software suite such as EnCase. Finally, If all fails, you can always use hardware write blockers.

Q: Are there other ways to access deleted files in the usbimage.001 file?

A:  When opening the usbimage.001 file in Autopsy and trying to recover the deleted file (i.e. dreamCar.jpg), as shown the chapter 5 movie “Searching,” if you don’t see the deleted file in the Data Sources tree, you can still view and extract the deleted file in the Views tree as shown below.

Skills covered in this course
IT and Hardware IT

Continue Assessment

You started this assessment previously and didn't complete it. You can pick up where you left off, or start over.

Start My Free Month

Start your free month on LinkedIn Learning, which now features 100% of courses. Develop in-demand skills with access to thousands of expert-led courses on business, tech and creative topics.

Start My Free Month

You are now leaving and will be automatically redirected to LinkedIn Learning to access your learning content.