
218 䡲 Cyber Forensics Field Manual, Second Edition
Table 7.6 (continued)
2. Note that evidence may need to be referred to in cases of corporate policy violation.
K. Collect and store evidence.
1. Collect and securely store evidence including:
Hard disk drives
Floppy drives
A backup
Other storage media
Printouts
E-mail messages
Logs
Other fi les in paper or electronic format
䡲
䡲
䡲
䡲
䡲
䡲
䡲
䡲
2. Ensure that evidence is stored securely to prevent accidental or intentional modifi cation
or destruction of evidence.
Corrective Measures
L. Transmit evidence to the IRT.
1. Transmit evidence to the IRT in a manner commensurate with the physical nature and
security sensitivity ...