Computer forensics

17.04.2006

- Document everything that's done.

- Never go beyond what is known and can be proved from direct, personal knowledge.

Failure to protect evidence might mean that original data is irretrievably lost or changed and that results and conclusions may not hold up or be admissible in a court of law.

How It Works

While the circumstances of each case will differ, some elements are common to most computer forensic investigations. Here are some actions you should take: