Incident Response & Computer Forensics, 2nd Ed., 2nd Edition

CHAPTER 9

Evidence Handling

 

There are few events in the field of computer security as satisfying or worthwhile as a successful courtroom experience. If a computer security incident you have investigated leads to a court proceeding, the digital evidence and documents you obtained are likely to be used as exhibits in the trial. Special rules exist to ensure that the exhibits are genuine and exactly what they purport to be. Therefore, during adverse civil or criminal proceedings, your collection, handling, and storage of electronic media, paper documents, equipment, and any other physical evidence can be challenged by an adversary.

It is important that you follow and enforce evidence-handling procedures that will meet the requirements of the ...