Acquiring Electronic Evidence
Digital evidence can be collected from many sources including computers, cell phones, PDAs, digital cameras, hard drives, CD-ROM, USB memory devices, and more. Special care must be taken when handling and analyzing computer evidence to avoid spoliation of crucial evidence.
When acquiring electronic evidence, preservation of evidence is vital.
Acquisition of evidence starts by creating a forensic image, at the sector level. A bit-stream copy of the entire media being imaged is created using a write protection device or application to prevent contamination and maintain evidentiary status.