Fundamentals of Information Systems Security, 4th Edition

Collecting, Seizing, and Protecting Evidence

Evidence serves several important purposes during the course of a forensic investigation. It can provide clues to help investigators determine what happened during an incident and can provide the basis for assigning liability or guilt in a court of law. Any time evidence is destined for a court of law, it must first be subjected to rigorous standards to ensure it is pertinent and in its original state.

The Importance of Proper Evidence Handling

Evidence is useful only when it provides compelling documentation of events that occurred in the past. Any questions about a lack of authenticity or presence of tampering will likely render that evidence inadmissible in a court of law. Admissibility is the ...