In this section we are going to discuss collecting evidence after a security event.
In some cases the evidence collected may need to be used in the court of law.
So it is crucial that the proper procedures are followed.
The best evidence is evidence that is in its original form such as a copy of a hard drive from a computer
that has been compromised corroborative evidence is evidence that is based on a theory that is supported
by the initial case evidence indirect evidence is evidence that it is dependent on a connection to additional
evidence such as fingerprints or DNA laughed at the scene.
Once evidence is collected it needs to be handled properly to make sure it is not altered or damaged.
First evidence should be labeled with the investigators name the date and case number then it should
be preserved with the right protection in place in an anti-static bag or Faraday cage to prevent electric
energy from harming the evidence.
Finally you need to make sure to maintain the proper chain of custody by accurately documenting any
transfers of evidence.
If you do not follow these steps then evidence may not be valid in the court of law.
The common piece of evidence obtained during most investigations are disk images.
Some common tools out there that can be used for disk imaging are sincere cane and case a disk image
as a computer file containing the contents of a data storage device such as a computer hard drive.
It is important that when doing computer forensics images are not altered in a real world scenario.
If you were to get evidence from a search warrant or by a discovery motion and were to obtain a physical
copy of a hard drive from a computer you would need a right blocker right blockers are devices that
allow you to get information on a drive without accidentally damaging the drive contents.
If you want to learn more about disk imaging check out the link that I have provided as a resource for
this lecture.