Computer Evidence : Collection & Preservation

Computer Evidence: Collection & Preservation teaches law enforcement and computer forensics investigators how to collect evidence effectively to preserve its reliability and usefulness in prosecution.

The book focuses on collection and preservation because these two phases of computer forensics are the most critical to evidence acceptance, but are not thoroughly covered in text or courses.

Intended to be a desktop reference and field guide, this book teaches law enforcement and computer forensics investigators what forces act on data during evidence identification, collection, and storage.

The simple act of a computer forensics investigator shutting down a suspect's computer changes the state of the computer as well as many of its files, so a good understanding of evidence dynamics is essential when doing computer forensics work.

Broken up into five parts, Computer Forensics & Evidence Dynamics, Information Systems, Data Storage Systems & Media, Artifact Collection, and Archiving & Maintaining Evidence, the book places specific focus on how investigators and their tools are interacting with digital evidence.By reading and using this task-oriented guide the computer forensics investigator will be able to ensure case integrity during the most crucial phases of the computer forensics process.