All procedures are carried
out to strict law enforcement standards. In every case all evidence
is treated the same, regardless of the nature of the enquiry.
Once the evidence is collected in most cases it is not
possible to re-obtain it, as it will most likely be contaminated
through mishandling.
Therefore every case is treated as if it
was going before the court and collection of evidence is done to
International Computer Forensic Criminal Standards.
This
involves never accessing the subject computer for examination, but
using sterile media and a write blocker and obtaining an evidential
standard copy of the electronic media.
A link to these standards can be found here:
http://www.cops.org/forensicprocedures
|