11. Collecting and Preserving Digital Evidence

• Focus is on the contents of the computer as opposed to the hardware.

• Consider two methods of copying information:

  1. Copying only information that is needed

     • advantage -- easier, faster, and less expensive;

     • disadvantage -- possibility of overlooking or damaging evidence;

  2. Copying everything.