Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

Share this Page URL

Introduction > Introduction - Pg. 135

Seizure of Digital Information · Chapter 7 135 are logically organized into something meaningful will be called a data object. The choice to use the term "data object" instead of the more frequently used term "file" is based on the fact that not all organized digital information comes in the form of a file. Information attached to a file such as a file header and metadata are not technically separate files, but can be culled out from the file as separate data objects. Other types of information found on storage media are not files, but frag- ments of files left by the constant write and overwrite of information caused by the deletion of existing files and the creation of new files. For example, a certain amount of an old file may be left behind when a new file is overwritten in the same space--so-called file slack space. Still other types of informational fragments may include files and com- mands temporarily stored in the swap file or within the RAM itself. For these reasons, I believe it is more appropriate to call these organized pieces of information "data objects." What we consider to be evidence has a dramatic effect on how we view the electronic crime scene.The current model of digital evidence seizure is