Methods driving the interaction between investigators, their tools, and technologies are in as constant a state of change as the data they are analyzing. Even the basic principles of the International Organization on Computer Evidence (IOCE) address the rapid changes within the profession and the need for corresponding methodologies.
Following are the International Organization on Computer Evidence (IOCE) principles [Ioce01]
When dealing with digital evidence, all of the general forensic and procedural principles must be applied.
Upon seizing digital evidence, actions taken should not change that evidence.
When it is necessary ...