There are a number of parallels between digital forensics and other forensic disciplines such as trace evidence. The key parallel is that organizations acquiring evidence need to have a procedure that is sound, reproducible, and well documented. The following are some guidelines for proper collection of digital evidence:
- Photograph the system and the general scene. One the key pieces of equipment that can save time is a small digital camera. While it may seem overkill to photograph a system in place, in the event that actions taken by incident responders ever see the inside of a courtroom, having photos will allow for a proper reconstruction of the events. One word of caution though is make sure to utilize a separate digital camera. Utilizing a cell phone may expose the device to discovery in the event of a lawsuit or criminal proceeding. The best method is to snap all of the photos necessary and at a convenient time and place, and transfer them to permanent...