The purpose of this practice is to describe techniques and procedures for computer forensics in regard to evidence handling, computers, digital imaging, and forensic analysis and examination.

The examiner should be trained in accordance with Guide E2678.

Individuals not trained in proper digital evidence procedures should consult with an appropriate specialist before proceeding.

When dealing with technology outside your area of expertise, consult with an appropriate specialist before proceeding.

1.1 This practice describes techniques and procedures for computer forensics within the context of a criminal investigation.

1.1.1 This practice can be applicable to civil litigation.

1.2 This practice describes seizing possible evidence, proper evidence handling, digital imaging, forensic analysis/examination, evidence-handling documentation, and reporting.

1.3 This practice is not all inclusive and does not contain information relative to specific operating systems or forensic tools.

1.4 The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard.

1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.