Abstract

Seeking to preserve electronically encoded evidence implies that an incident or event has occurred requiring fact extrapolation for presentation, as proof of an irregularity or illegal act. Whether target data are in transit or at rest, it is critical that measures be in place to prevent the sought information from being destroyed, corrupted or becoming unavailable for forensic investigation.