Uncovering Digital Evidence: A Guide to Investigating Physical Hard Drives for Criminal Investigations

Imagine you are given a hard drive that you need to examine for a criminal investigation. As is for handling all evidence, you need to be extremely careful how you examine it and with the correct tools, since an improper approach can corrupt it, making it unuseful. This post is about how to handle digital evidence, specifically, the investigation of a physical hard drive while a similar approach is also applicable to other storage devices.