The importance of recovering and preserving digital evidence collected from a broad range of devices and the processes used to do so are looked at in this chapter. The chapter explains the importance of preserving digital evidence in line with legal expectations. It describes the forensic processes and tools used to acquire digital evidence without undue contamination. The topics covered in this chapter are as follows:
The concept of the chain of custody in relation to the preservation of evidence from its collection up to its tendering in legal proceedings
The acquisition and safe custody of digital devices and data
The recovery of digital evidence through forensic imaging processes, also known as dead recovery
The acquisition of digital evidence through live recovery processes
The efficacy of existing forensic tools and the emergence of enhanced tools
Case studies that highlight the processes and pitfalls of recovering and preserving digital...