Digital evidence can support investigations, disciplinary matters, litigation and incident response when it is identified, preserved, examined and explained appropriately.
What good practice looks like
The intended use determines the necessary acquisition, continuity, validation and reporting. Investigators should preserve context as well as individual artefacts.
Risks and common mistakes
Screenshots alone may omit provenance, metadata and surrounding context. Delay can also result in loss of cloud, account or log data.
Develop capability
Related trainingBuild structured practitioner capability →Related serviceDiscuss an organisational requirement →
Speak to Sorinteq
If your organisation needs training, an assessment or specialist support in this area, describe the requirement and intended outcome.
Discuss digital evidence