Particularly important data is selectively read out and saved on a desired medium.
In which cases can extraction be considered?
- Recovery of deleted or archived data: when important data has been deleted accidentally or intentionally
- Identify court-acceptable electronic evidence for use in a legal proceeding.
- Missing an important application: when important applications have not been installed on a new system and the installation and execution files have been archived on tapes