When digital evidence is encountered during an investigation, many questions arise:
What is the best method to preserve the evidence? How should the evidence be handled? How should valuable or potentially relevant data contained be preserved?
The key to answering these questions begins with a firm understanding of the characteristics of digital evidence.