Digital evidence, acquisition and bounded forensic conclusions
Establish authority and the investigative question
A digital investigation begins with the actual incident, permitted scope, responsible owner and evidence question. Incident response and forensic examination overlap but have different immediate objectives. A necessary containment action can change relevant state, so document decisions, authority and observed effects. Do not assume a certification or a copied technical procedure supplies legal authority to seize, access or disclose every connected system. Applicable legal and organizational requirements require their actual qualified review.
Preserve identity and handling history
Record the evidence identifier, source, acquisition method, relevant times, handlers, transfers and protected storage. A chain-of-custody record supports accountable handling; it is not a magical guarantee of admissibility in every jurisdiction. Integrity hashes can support comparison of captured bytes, but matching hashes do not establish who created the data or whether the source contained a truthful account. Protect originals and use controlled working copies where appropriate. An acquisition image, logical export and screenshot have different coverage.
Choose an acquisition for the actual state
Volatile and persistent data have different loss/change risks. The order-of-volatility idea guides prioritization under feasible approved conditions, not an instruction to collect inaccessible CPU state before protecting human safety or critical services. A live acquisition necessarily interacts with a running system and should record its tools and effects. A hardware write blocker can restrict supported examiner-origin writes to a storage source, but device-internal activity and unsupported interfaces still require analysis. Imaging the wrong disk perfectly does not answer the intended case.
Verify and explain limitations
A successful acquisition tool run does not establish that every relevant sector, encrypted volume or remote artifact was captured. Check expected coverage, errors, hashes and access to required keys under the actual authorized model. An SSD’s deletion behavior, RAID layout, snapshots and cloud logging can change what remains recoverable. Record conclusions supported by the evidence and distinguish observed facts, reasonable inference and unresolved alternatives. No evidence is acquired, device powered off or account accessed by these written exercises. They provide technical reasoning rather than legal advice, a complete forensic lab or proof of practical professional competence.