The overriding principle concerning all phases of seizing and processing electronic evidence i.e. seized computers, disks and other media, should be never to alter the evidence from its original state. This should ensure its admissibility in court or other legal proceedings. The processing officer should carefully document every step taken while processing the electronic evidence. All seized computer hard disks, diskettes or other media should be “write protected” because electronic media that has been “write protected” cannot be altered or erased either intentionally or accidentally. A “bit-stream” identical copy of all hard drives, diskettes or other media must be made prior to any processing…
