Digital Forensics in Small Devices: RFID Tag Investigation

12. However, the acquisition was cancelled due to the fact that the investigator
thought the acquisition by using the default compression method could
save the time to acquire the evidence from the flash drive B. But, there
was not affect on the collected evidences even though the data
compression method was used.
Figure A12.10: Screenshot of the cancellation of acquisition process
13. Created a new case and performed the same steps (1 to 9) mentioned
above and chose the options (see the Figure A12.11) for acquisition.
Figure A12.11: Screenshot of the new acquisition process using data compression
level
111