This chapter looked at evidence recovery and preservation in a general sense and then focused on how these two interlinked requirements relate to digital evidence. From the physical safekeeping of the exhibits that hold digital information to the recovery of it in its digital form, the chapter outlined the responsibilities of practitioners as well as the challenges that confront them in evidence handling.
Dead and live evidence recovery processes have been described, although these well-established processes are now facing a paradigm shift heralded by enhanced technologies. New and sounder ways of recovering and preserving evidence were presented as was a more reliable and efficient way of forensic imaging.
Chapter 5, The Need for Enhanced Forensic Tools, will look at new processes and technologies that address and overcome some of the disadvantages of live recovery by introducing some "disruptive technology" that has arrived just in time to give practitioners the edge in forensic...