Applying medical diagnostic principles to digital forensics
by Sean McLinden
"Traditionally, computer forensics begins with the seizure of all possible evidence then test, test, test until either you find something or you decide that there is nothing to be found. To paraphrase an example attributed to Rob