IT principles in digital investigation 2

As the lead for a digital forensics team you are now being asked by the forensics manager to give a training session on how to acquire digital evidence. The session must be given to your junior forensics team. In this training session you will need to demonstrate how to acquire digital evidence without causing alteration through the use of both hardware and software write blocking and the preferred technology for this write blocking. In addition the training must demonstrate how investigators perform detailed analysis of the evidence collected from formatted media deleted files allocated space swap space slack space encrypted space and unallocated space. These two demonstration areas are the most critical steps for junior investigators if they are to both completely understand the evidence acquisition process and places where suspect data may hide on formatted media.
Provide the following in a 57 slide PowerPoint presentation:
The presentation should be a minimum of 57 PowerPoint slides in length including speakers notes (250 words minimum) not including the title and reference slides and neatly formatted.