Back in 'the good old days', we could get away with almost anything and trial attorneys didn't know enough about computer evidence to ask the right questions. We knew very little and the attorneys and judges knew even less. However, times have changed. Computer evidence processing procedures have evolved into standards and procedures that must be followed. Furthermore, the expenses associated with the processing of computer evidence need to be included in law enforcement budgets.
Computers are here to stay and the processing of computer evidence can be expensive.
Short cuts invite serious evidence problems and should be avoided at all costs. Obviously, a complete training course in forensic computer science is outside the scope of this article. Also, you should not boot or run the computer using the operating system on the computer in question. It is relatively easy for criminals to rig their computers to destroy hard disk drive content or specific files by planting decoy programs or through the modification of the operating system. By way of example, the simple DIR instruction which is used to display the directory of a disk can easily be rigged to reformat the hard disk drive.