Digital evidence includes emails, messages, logs, photographs, and device records that may be important to a business investigation. How you collect and handle them affects how useful they will be later.
Preserve digital evidence before analyzing
Whenever possible, preserve the original source before making changes. Copies used for review should be distinguishable from the original data.
Record where evidence came from
Document the system, account, device, person, or source associated with each item. Context matters as much as content.
Maintain chain of custody when needed
For matters that may become legal, disciplinary, or insurance issues, record who collected, transferred, stored, and accessed important evidence.
Avoid unnecessary alteration
Opening, exporting, renaming, or converting files can change metadata. Use appropriate procedures when metadata or authenticity could matter.
Separate digital evidence from interpretation
The investigative report should identify what the evidence directly shows and distinguish that from analysis or inference. This makes the work easier to review and defend.
Start here
Identify the records relevant to the matter and who controls them. Establish how they will be preserved before anyone begins changing files or reviewing devices.
About Total Technical Solutions
Total Technical Solutions. People Solutions Results. We help with project delivery, business operations, websites, and training. Visit Total Technical Solutions or view more TTS articles.