1. Explain the process used to preserve the verifiable integrity of digital evidence. How does this ensure that data are preserved unmodified? How can an analyst show that the original evidence is unmodified?
2. Trace and explain how the hardware of a computer orga-nizes and stores information for later retrieval from an active file being processed in the processor chip to a mass storage device ( hard disk or removable storage). What is the trend in terms of speed in this progression of components? What is the trend in terms of the size and capacity in this progression of components?
3. Describe in broad terms how the software of a com-puter organizes information for storage and later retrieval. Does this process yield any potential loca-tions for latent digital evidence? Is latent evidence always intact? Why or why not?
4. What advantages are offered by commercial forensic packages? Are there any disadvantages to using them? If so, what are they?