regardless of the operating system, every file has a specific structure to arrange its components, those components are file name, size, signature, contents, etc. the file structure is universal and the same for any operating system.
metadata, in general, is defined as Data describing other data. file metadata is the data that describes the file itself and is used by the OS application to make an opening, recognition, and processing that the file easier.
metadata is found in a different location, but as a starting point, the three locations you need to start looking for metadata when analyzing a file…
Data Acquisition means is the process of taking an image from a suspect’s machine.
Type of Data Acquisition:
important to note: imaging isn’t copying
Dead Acquisition refers to the attempt to acquire data from the suspect’s machine without the operating system. Reason: the suspect’s OS cannot be trusted.