Techniques

Although the techniques for investigating computer forensics are limited only by an investigator's imagination, here are some guidelines on tried and true methodologies.

Techniques

• Data Reduction - By eliminating information that doesn't matter, an investigator is left with information that does matter.
• Locard's exchange principle

Guidelines

• RFC 3227, "Guidelines for Evidence Collection and Archiving," D. Brezinski and T. Killalea, February 2002.