The practitioner takes possession of the physical exhibits that contain digital evidence, which are kept in secure storage in exactly the same way as other exhibits. As discussed in Chapter 3, The Nature and Special Properties of Digital Evidence, the courts recognize the increased risk of evidence tampering and authentication problems with digital evidence. Tampering of digital evidence is relatively easy and has, in the past, created great uncertainty about its soundness. The use of reliable forensic tools minimizes the risk of evidence contamination during formal recovery of digital data. Regrettably, the immature status of digital forensics as a scientific discipline continues to cause disagreement over defining helpful and broadly accepted standards and processes.
A practitioner has the option of undertaking a dead recovery or a live recovery of data from a computer believed to hold evidence of value. However, the practitioner...