
92
DIGITAL FORENSICS EXPLAINED
residence, the organization is imperative. e lead digital forensic investigator in this
case marks all original evidence and documents serial numbers on photocopied hard
drives with a form that he developed to assist the organization. An example of the
form is shown in Figure 7.1.
It is recommended that investigators remember how important an organization is,
develop their own refined method, and use it every time to establish a routine that if chal-
lenged by defense attorneys can be pointed to as consistent and successful. e refined
method should be based on a proven method or combination of methods. e refined