Preservation of evidence "How many file changes is considered contamination of digital evidence?"

General (Technical, Procedural, Software, Hardware etc.)

Last Post by sdcoker 4 years ago

1 Posts

1 Users

0 Reactions

1,570 Views

RSS

sdcoker

(@sdcoker)

Eminent Member

Joined: 12 years ago

Posts: 14

Topic starter 21/04/2023 2:41 am [#19879]

When I do an iPhone extraction from my own iPhone or Android of mine or from someone I know, It's usually 10 or 12 DBs modified or maybe no more than 100 file changed. I'd like to start a discussion to determine what the standard for preservation is. Same for a Windows or Mac where 1500 seems excessive.

Quote

Topic Tags

Preservation of evidence