Digital forensics: The evidence we collect must be accurate, complete, authentic, convincing,
admissible. To ensure the disk is not written to and inadmissible, we can use a write blocker. For
instance, a Tableau write blocker. Everything is documented. Chain of custody: who had it when? What
was done? When did they do it? Pull the original, put it in write protected machine, we make a hash.
We only do examinations and analysis on bit level copies. We confirm they have the same hash as the
original before and after examination.