Question:
Examination of Evidence on Original Media:Computer Forensics
The "forensically sound" method is to never conduct any examination on the original media. There are practical and legal reasons for not performing the examination on the suspect's computer, but sometimes you have to compromise. If we make a compromise, is it acceptable by the court? What is the best practice for us to deal with these scenarios?