All part of one question:

a. What are metadata? What are volatile data? Why are metadata and volatile data important in an investigation?

b. What is encryption? how can encryped files affect an investigation? How do you actually encrypt files? Is there software involved? List examples.

c. In the field of computer forensics, what is imaging? What is a write blocker? What is the difference between software and hardware write blockers? List at least 2 examples (brands) of either type (software/hardware) and give estimated costs.

d. How can an investigator validate that an exact copy of a hard drive was made? List at least two different examples (brands) of tools that can be used to make an exact copy of a hard drive and give estimated costs.

e. List the top 5 or so computer forensics tools widely used in the United States.