CISSP All Domains Practice test 5

Digital forensics: The evidence we collect must be accurate, complete, authentic, convincing, admissible. Everything is documented. Chain of custody: who had it when? What was done? When did they do it? Pull the original, put it in write protected machine, we make a hash. We only do examinations and analysis on bit level copies. We confirm they have the same hash as the original before and after examination.