6 䡲 Cyber Forensics Field Manual, Second Edition
as to exactly what might be a source of evidence (electronic or manual) [i.e., personal digital
assistants (PDAs), pagers, fi les, laptops, hard drives, storage area networks (SANs), etc.]. e
physical housing containing the technology is not electronic evidence, although the physical
housing may provide additional evidence of a non-electronic type (e.g., fi ngerprints, serial num-
bers, etc.), the housing is merely a receptacle for the electronic evidence, which resides stored on
drives, or in fi les. e cyber forensic investigator must determine and must identify what and
where the electronic evidence is to be collected.
Collection or extraction is the process of physically gathering the electronic ...