Electronic Evidence Acquisition ~ Computer Forensics

 

Electronic Evidence Acquisition

Digital evidence can be collected from many sources including computers, cell phones, PDAs, digital cameras, hard drives, CD-ROM, USB memory devices, and more.

Special care must be taken when handling and analyzing computer evidence to avoid spoliation of crucial evidence.

 

When acquiring electronic evidence, preservation of evidence is vital

Electronic evidence acquisition: Acquisition of evidence starts by creating a forensic image, at the sector level. A bit-stream copy of the entire media being imaged is created using a write protection device or application to prevent contamination and maintain evidentiary status.