Data Forensic Policies for Evidence Collection

    Preservation

•    Collect all information and computers for preservation from the authorized custodian and store securely  

•     Create a chain of custody and document everything pertaining to the evidence 

•     Create an evidentiary copy of  the hard drive using approved  and  tested computer forensic software

•     Always use sanitized media  to store the evidence. 

    Documentation

•     Document all procedures and chain of custody

•     Documentation of  all steps performed to gather evidence is a critical  and  integral part of any investigation

    Trust

•    Never trust the subject's operating system or network

•    Never log on to or boot up a subject's original operating system

•     If the subject's operating system is turned on:

        record everything and disconnect the system in an appropriate method depending on OS and computer