4 ms·
For chain of custody etc. you always need to make a master copy and sign/hash it and then work off of a copy. If you tried to do forensics on the actual compute
by trotsky 15y ago
For chain of custody etc. you always need to make a master copy and sign/hash it and then work off of a copy. If you tried to do forensics on the actual computer as seized you'd be busy destroying disk & memory evidence as you worked.
- X-Istence 15y agoThat is fine for working on it (and having taken computer forensics classes at college something I am intimately familiar with), however it no longer needs to be done on location. The device can safely be removed without requiring a tech to go out to the location.