In order to solve a cybercrime alleged to have been committed, appropriate digital evidence have to be identifed, collected, analyzed and evaluated as to the suitability in the court of law. Every sequence of events with

Precautions to be adopted by Digital Forensics Expert Take image of computer media using a write-blocking tool to ensure there is no data added or modification done to the suspected device. The process of creating an exact duplicate of the original evidentiary media is called imaging. Using hard drive duplicator or software, the entire hard disk drive is completely duplicated. The original disk drive is then securely stored to prevent tampering. Establish and maintain Chain of Custody: Chain of custody means the chronological documentation, trail that indicates the seizure, custody of digital evidence, control, transfer, analysis and disposition of evidence, physical or electronic. Digital evidence by its very nature is invisible to the human eyes and hence evidence must be developed using sophisticated tools. The chain of custody requires that from the moment the evidence is collected, every transfer of evidence between persons should be documented to prove that nobody else could have accessed to that evidence. If the chain of custody is broken, the defendant can ask the court to declare the evidence as admissible. Document everything Use only the tools and methods that have been tested and evaluated to validate the reliability of digital evidence. Most valuable information that can be obtained in the course of digital forensic examination will come from interviewing the users, witnesses and the suspects. It can yield valuable information about the system configuration, applications, encryption keys and methodology to access encrypted files and network servers. Without legal authority and unless the owner of the digital evidence has given consent to have the media examined, special care must be taken not to seize, copy and examine the data. Due to the growing use of cryptographic storage, it may be that the only copy of the keys to decrypt the storage is in computer's memory. If the computer is switched off it will cause that information to be lost.