How to prepare a windows-based computer for a forensic investigation Forensic investigators use specific hardware and software to examine computer systems. The increased adoption of Windows operating systems has made computer forensic investigators use Windows-based platforms as sources of digital evidence. The first step involves taking the image of the computer suspected to have crucial digital data. If crucial evidence is suspected to be held in volatile storage, then a live analysis is conducted, but a dead analysis is performed when the evidence is thought to be contained in permanent storage disk locations. A Windows-based computer would require retrieval of information before shutting down the computer. However, if the information is thought to be contained in the permanent storage, then a computer has to be shut down before transporting it to a laboratory for forensic analysis. A computer forensics expert should be careful not to change data held in non-volatile storage when powering down the computer. When using a Microsoft Windows system, the information stored in non-volatile storage could be prevented from interference by removing the power cord from the socket (Nelson, Phillips & Steuart, 2010; Easttom, 2014). The first step in the laboratory examination would involve analysis of the status and setup of the computer. The computer should be booted and BIOS setup selected. Caution should be taken so that the Windows-based computer does not use internal digital devices to boot. Alternatively, internal drives should be disconnected so that they would not interfere with the intended booting procedure (Nelson et al., 2010; Taylor, Haggerty, Gresty & Lamb, 2011; Easttom, 2014). At this point, information could be retrieved from the computer for forensic analysis. How to handle digital evidence Digital data could be changed easily, and this could interfere with the integrity of digital information. Also, alteration of digital data could make it difficult to differentiate original data from copied data. There are four principles that are followed when handling digital evidence (Easttom, 2014). First, digital evidence should be collected in a manner that does not cause changes in the form of data. If the data are changed, then the integrity of the data could be compromised. Secondly, only trained persons should be allowed to handle digital evidence. Persons who are trained could handle digital evidence professionally and be responsible for breaching ethical, legal and professional standards (Nelson et al., 2010). Also, digital evidence that is professionally handled by trained personnel could have higher chances of being admissible in court than digital evidence handled by untrained persons. Third, all processes used to analyze digital evidence should be well documented and stored for reviews in the future. There should be clear reasons for any changes that are done on the digital evidence. This helps to hold professionals responsible for their actions. Fourth, computer forensic experts should examine copies of original files suspected to contain evidence (Easttom, 2014). In other words, original files should not be examined or manipulated. Gathering data The quality of evidence gathered in computer forensics greatly depends on the law enforcement and procedures used when gathering the evidence (Nelson et al., 2010). The law is clear about specific legal guidelines that should be followed when handling forensic evidence. For example,