Digital forensics: The evidence we collect must be accurate, complete, authentic, convincing,
admissible. Everything is documented. Chain of custody: who had it when? What was done? When did
they do it? Pull the original, put it in write protected machine, we make a hash. We only do
examinations and analysis on bit level copies. We confirm they have the same hash as the original
before and after examination.