Notes

Some potential tools used to examine the five digital evidence pieces I identified for the cyber security breaches:
Acquisition
Two commercial products that can be used to obtain forensic photographs of digital evidence from storage devices and memory cards are FTK and EnCase Forensic. By creating a bit-stream a copy of the evidence, these techniques ensure against any alteration of the original material.

Validation and Verification
Hashing is a feature of all the mentioned tools like ProDiscover, OSForensics, AccessData FTK, and EnCase Forensic. A technique called hashing gives a piece of digital evidence a distinct mathematical value. We can use this value to confirm that there has not been any tampering with the evidence since it was obtained.

Extraction and Reconstruction
• Full-featured digital forensics tools like EnCase Forensic and FTK provide a range of functions for data extraction and reconstruction from digital evidence. These features include the capacity to recognise file sections, analyse file headers, and extract deleted files.
• While EnCase Forensic and FTK may offer more functions than OS Forensics version and Pro Discover, they are more basic tools. They might still be helpful, although, for obtaining the most basic information from digital evidence, like text files and pictures.

Analysis
Digital evidence analysis can be done with any of the tools mentioned above while EnCase Forensic and FTK provide more advanced forensic analysis features, like the capacity to make timelines of events and search for keywords and patterns in data.

Example
For example, we can use EnCase Forensic or FTK to import the logs into the tool while looking through traffic control data to discover anomalies from typical traffic patterns during cases of fake emergency warnings as described before. Next, I can utilise the search functions of the programme to look for trends in the data, including sudden increases in traffic or odd traffic patterns.