Evidence collection procedures

There are a number of parallels between digital forensics and other forensic disciplines such as trace evidence. The key parallel is that organizations acquiring evidence need to have a procedure that is sound, reproducible, and well documented. The following are some guidelines for proper collection of digital evidence:

  1. Photograph the system and the general scene. One the key pieces of equipment that can save time is a small digital camera. While it may seem overkill to photograph a system in place, in the event that actions taken by incident responders ever see the inside of a courtroom, having photos will allow for a proper reconstruction of the events. One word of caution though is make sure to utilize ...

Get Digital Forensics and Incident Response now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.