Evidence Preservation
Before you can prove that you maintained the integrity of data you present as evidence, you must prove that you maintained the integrity of the hardware that contains the data. From the beginning of your investigation, you must take precautions, and document those precautions, to protect the hardware.
The main goal of evidence preservation is to ensure that absolutely no changes have taken place since the evidence was collected. Your collection and handling procedures will be examined. Take all necessary precautions to protect collected evidence from damage that might change its state. Static discharge is a significant concern. You must bring static protection devices with you to each investigation. Use them, and make notes ...
Get Computer Forensics JumpStart, Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.