You are investigating an email fraud case on a suspect computer. Youhave been given limited access to the suspect computer. What is the bestdata acquisition method that you will use in this scenario? Provide reasonswhy this is the best selected method. Explain the acquisition process indetailexplainingits advantagesand limitations?[2 +1.5 +1.5marks]

You are appearing in a court of law for a case hearing as an expertdigital forensics examiner. Your role in this court appearing will be as anexpert witness. Explain in detail what is the difference between an expertwitness and a fact witness in the court of law? How will you approach tothistestimony as an expert witness?[3 +2 marks]