Title: Evidence Handling - an overview | ScienceDirect Topics
Headings: Evidence Handling
Evidence Handling
Incident Evidence
Computer Forensics in Today's World
A Note on “Common Office Technology”
Evidence Presentation
11.3.3 Evidence Handling
Collecting and Preserving Digital Evidence
Publisher Summary
Evidence Management
Search and Seizure
Forensics Process
Prepare
Defending against MCRs
Gathering Evidence and Restoring the Machine
Tip
Case Processing
9.9.1.5 Evidence Integrity

Content: It is very easy for a criminal to deliberately delete crucial evidence in an instant or for an officer or technician to unintentionally damage or destroy it. In many cases, evidence that appears to be gone is still on the disk or other media and can be recovered. A number of data recovery software packages are on the market, several of which are designed specifically for computer forensic work and are marketed with law enforcement use in mind. Once one or more duplicates have been made, the original can be locked up securely in an evidence locker or evidence room until needed. Chain of custody must be maintained throughout the entire process. The duplicate disk can be examined for evidence of criminal activity. View chapter Purchase book
Read full chapter
URL: https://www.sciencedirect.com/science/article/pii/B9781597492768000157
Evidence Management
Jason Sachowski, in Implementing Digital Forensic Readiness, 2016
Search and Seizure
Once the scene is secured and thoroughly documented, investigators work to seize evidence. But the goal of seizing evidence is not to seize everything at the scene. Through the knowledge and experience of trained investigators, educated decisions can be made about what evidence need to be seized and then documenting the justifications for doing so.