Additional tools are available at the ad hoc IP tools page. Before attempting to collect evidence from a computer, it is important to have a solid understanding of how forensic science is applied to computers. It is also critical to follow a standard procedure when collecting evidence to ensure consistency and avoid mistakes or oversights. You need to be able to demonstrate that the evidence is what you say it is, came from where you say it came from, and has not been modified since you obtained it. How you document evidence to demonstrate that it is authentic and reliable depends heavily on the circumstances and the computer systems you are dealing with.
Software is available to preserve evidence stored on a standalone personal computer.
A number of these products are compared in this SC Magazine market survey . Even the most basic computer intrusions can be very challenging from a technical and investigative standpoint. Inexperienced intruders can use freely available toolkits that automate very technical tasks that make investigation more difficult. Also, because of the distributed nature of the Internet, a single intrusion often has related evidence in multiple jurisdictions. Several checklists exist to help system administrators investigate an intrusion but these guidelines do not consider evidentiary issues.