Practical Windows Forensics

Digital evidence

As a normal reaction, the change in technology led to a change of possible evidence, as compared to previous traditional evidence. All the components of the computer system could be evidence, such as the following:

• The hard drive of the criminal or the victim
• The operating system artifacts and special files
• The network traffic
• The computer memory
• Mobile phones and tablets
• Cloud storage
• Shared storage
• Network devices
• The systems' logs
• The devices' logs
• GPS devices
• Simply, any device that can store or process data

Due to the wide range of possible evidence, the incident handler or first responder who will handle and process the available devices in the incident scene must have sufficient experience in dealing with whatever types of evidence ...