The Global Cybercrime Ecosystem and Cybercriminal Investigation 315
All of this presupposes the following:
• that the investigator has the necessary technical background;
• that the data collected are an identical copy of the original data (no
changes made to the data or the media);
• that the correspondence between the data presented and the original
data can be demonstrated and authenticated;
• that in the case of storage media that have been damaged or destroyed,
intentionally or otherwise, any data supposed to have been deleted or
destroyed can be recovered in a useful form and condition; and
• that records of the time (time and date stamping) and the place of col-
lection of data are systematically recorded, authenticated, and stored ...