During a  criminal case investigation, a computer was taken as part of the  evidence. The computer was found with a flash drive connected to one of  the USB ports. It is suspected that this flash drive contains image  files relevant to the case. Preliminary investigation revealed that the  owner of the computer had the chance to delete some of image files.  Other files were renamed so that they do not look like image files. It  is also suspected that steganography was used with some of the files to  conceal important information. The passphrase used for this purpose is  hidden in the device slack space 

 You are  the computer forensic investigator on duty and are called to process  this case. List the general steps and tools required to begin  investigation. In addition, because it is a high level profile case,  processes must be carefully documented. 

 Acquire a bit-stream copy from the flash drive 

List the general steps and tools required to complete this exercise and report the steps you need to perform these tasks.