11. competent forensic examination -- integrity of the original media

• What are three essential requirements for a competent forensic examination?

  • Second -- The examination must maintain the integrity of the original media.

  • the evidence found on the original media shall remain intact.

  • The evidence is forensically copied to some form of examination media.

  • Since examination media may be reused from one case to another, it is imperative that the examination media be totally wiped free of information from a previous case.

  • Steps must be taken within the forensics process to ensure that no new information is written to the evidence medium

  • No information on the evidence medium is altered

  • The actual physical medium is protected from harm so that it can be offered as evidence at trial, if necessary.