IT FORENSICS
Evidence acquisition and preservation
A documented process to identify sources and preserve data relevant to the examination.
Request an assessment
Activities to define in the assignment
- Inventory, identify and receive evidence; track transfers and handling.
- Select physical, logical or targeted acquisition according to the case.
- Working copies, hash values where applicable and examination logs.
Reporting the findings
Technical record, custody log and acquisitions in agreed formats.
Conditions and limitations
A hash supports integrity comparisons between data sequences; it does not alone establish origin, truthfulness or completeness.
Specialist work is agreed only after assessing feasibility, authorisations, expertise and tools required.
Watch the guides to methods and assignments ↗IT FORENSICS / CYBER-MED
Start with the question.
Describe the context, device or source and the purpose of the analysis. We will define scope and feasibility before acting.
info@cyber-med.it ↗+39 392 389 3524
Do not attach evidence, health data or confidential documents to the initial enquiry. Transfer arrangements will be agreed afterwards.