6. Evidence Identification, Acquisition and Preservation

Introduction and Context

Digital evidence is information of potential investigative or legal value that exists in electronic form. It may be stored on a laptop drive, mobile device, cloud platform, industrial controller, virtual machine, removable medium, or network appliance. It may also exist temporarily in volatile resources such as memory, active network connections, running processes, clipboard contents, and logged-in sessions. The central difficulty in handling such evidence is that digital systems are dynamic: data can change merely because a device is powered on, a process runs, a clock advances, or an investigator opens a file.

Evidence identification, acquisition, and preservation therefore form the operational foundation of digital forensics. Analytical conclusions are only as reliable as the evidence on which they are based and the method used to obtain it. A technically accurate finding may still be challenged if the investigator cannot demonstrate what was collected, how it was collected, whether it was altered, who handled it, and whether the tools and procedures were appropriate.

This chapter examines defensible methods for acquiring volatile and persistent data. It addresses forensic imaging, memory capture, write protection, live response, remote collection, tool validation, hashing, chain of custody, and minimization of evidence alteration. The emphasis is not merely on operating tools, but on making reasoned decisions under investigative, technical, organizational, and legal constraints.

Learning Objectives

After studying this chapter, the learner should be able to:

• distinguish volatile from persistent evidence and prioritize collection accordingly;
• explain the principles of forensic acquisition and preservation;
• select suitable methods for powered-off, powered-on, encrypted, remote, and cloud-connected systems;
• use write blockers, forensic images, hashes, metadata, and chain-of-custody records appropriately;
• evaluate the reliability and limitations of acquisition tools;
• design a defensible live-response or remote-collection procedure;
• identify common sources of evidence alteration and reduce their impact;
• assess ethical, legal, privacy, and organizational issues in evidence handling.

Evidence as a Forensic Object

Forensic evidence is not simply a file that appears interesting. It is information preserved in a manner that permits its origin, integrity, context, and handling history to be explained. Four properties are especially important.

Authenticity concerns whether the evidence is what it is claimed to be. An investigator should be able to associate an image with a particular device, storage medium, account, or collection event.

Integrity concerns whether the evidence remained unchanged after acquisition. Cryptographic hashes, controlled handling, write protection, and documented transfers support an integrity claim. A hash does not prove that the original acquisition was truthful; it demonstrates that the hashed object has remained unchanged since the hash was calculated.

Reliability concerns whether the acquisition method and tool operated correctly. A damaged disk, unsupported file system, unstable memory capture, or incorrectly configured collector may produce incomplete or misleading results.

Relevance concerns the relationship between the item and the investigative question. Collecting everything may be technically possible but may violate proportionality, privacy, policy, or legal authority. Preservation must therefore be broad enough to prevent loss but collection should be guided by purpose and scope.

Important Terminology

A physical acquisition attempts to obtain data from the underlying storage media, including allocated, unallocated, and potentially hidden areas. A logical acquisition collects files, directories, records, or application data presented by the operating system or application. A forensic image is a bit-stream representation of a storage source, generally accompanied by metadata and integrity values. A working copy is a duplicate used for examination, while the acquired master is protected from routine analysis.

Volatile data disappears or changes when power is removed or system activity continues. Examples include RAM contents, process lists, network connections, encryption keys, and temporary command output. Persistent data remains on non-volatile media, such as disks, solid-state drives, removable storage, and some cloud repositories, although it can still be modified by system activity.

A write blocker is hardware or software designed to prevent writes to a source medium while permitting authorized reading. A hash value is a fixed-length digest calculated from data. Chain of custody is the chronological record of evidence possession, transfer, storage, access, and disposition. Metadata describes an item’s attributes, such as timestamps, size, ownership, location, and collection details.

The Acquisition Decision: Preserve First, Then Extract

Acquisition is a decision process rather than a single command. Before touching a system, an investigator should determine the investigative objective, the authority for collection, the likely evidence locations, the operational state of the system, the risk of data loss, and the impact of intervention.

A useful priority rule is to collect the most volatile and most at-risk information first, provided that doing so is authorized and technically safe. A running server may contain encryption keys in memory, an active remote session, or a command history that will disappear during shutdown. Conversely, a powered-off computer may be best preserved by leaving it off and imaging its storage through a write blocker. There is no universal rule that a system must always be powered down or always be examined live.

The decision should consider at least five questions:

1. What evidence is likely to disappear if the system state changes?

2. What evidence may be altered by the collection action itself?

3. Is the device encrypted, remote, highly available, or safety-critical?

4. What collection is authorized and proportionate to the purpose?

5. Can the method be repeated, documented, and explained to an independent reviewer?

A practical acquisition plan identifies the source, method, tool version, operator, time standard, destination, storage capacity, hash strategy, expected interruptions, and contingency procedures. It also specifies whether the investigator will create a full physical image, a logical collection, a targeted export, a memory capture, or a combination of these.

Preserving the Scene and Recording State

Before collection, investigators should document the scene and system state. Photographs or screenshots may record cable connections, device labels, screen content, error messages, running applications, network indicators, and peripheral devices. Notes should include date and time, time zone, clock discrepancies, device condition, power state, logged-in users, visible encryption indicators, and actions taken.

Documentation is not a substitute for evidence, but it provides context. For example, a timestamp on a log may be misinterpreted if the system clock is incorrect. A photograph showing a running encryption application may explain why a live acquisition was necessary. A record of a connected external drive may help distinguish an original device from a later attachment.

The investigator should avoid casually browsing, opening documents, entering commands, or connecting unknown media. Every interaction can generate logs, update access times, trigger synchronization, execute scripts, or alter system state. If interaction is necessary, its purpose and expected effect should be recorded.

Acquisition of Persistent Storage

Physical Imaging

Physical imaging is generally preferred when the objective is to preserve the broadest possible representation of a storage device. It may capture operating-system files, deleted data remnants, file-system structures, slack space, partitions, boot records, and areas not visible through normal user interfaces. The source should be connected through a validated write blocker where feasible. The image should be written to a destination with sufficient capacity and protected from unauthorized access.

A typical workflow is:

• identify and label the source and destination;
• photograph and record device identifiers and condition;
• attach the source through a suitable write blocker;
• verify that the acquisition tool recognizes the correct source;
• select an appropriate image format and error-handling policy;
• calculate source and image hashes when supported;
• record start and completion times, tool versions, errors, and interruptions;
• verify the resulting image and secure the original source.

Image formats may be raw or feature-rich container formats. Raw images are simple and widely supported, but they may require large amounts of storage and separate documentation. Container formats can store compression, segmentation, metadata, and error information, but they depend more heavily on tool compatibility. The relevant choice is not which format is universally superior, but whether the format is suitable, documented, verifiable, and accessible to independent examiners.

Logical and Targeted Acquisition

Logical acquisition collects selected files, directories, databases, logs, or application records. It is useful when a complete physical image is impractical, when collection is limited by legal scope, or when data resides in a managed platform. It is also common in enterprise response, where investigators may need a rapid subset of information from many endpoints.

The limitation is that logical acquisition may omit deleted material, slack space, hidden partitions, alternate data streams, unallocated space, or files inaccessible through the current account. File-system timestamps and permissions may also be represented differently by the collection tool. Consequently, the investigator should state clearly what was collected and what was not.

Solid-State Storage and Remote Erasure

Solid-state drives introduce complications because wear leveling and garbage collection can make conventional recovery of deleted sectors unreliable. The investigator should avoid assuming that a sector-by-sector image represents a stable, permanent snapshot of every historical state. Device-specific behavior, TRIM operations, encryption, and controller functions may affect recoverability.

Network-connected devices may also receive remote commands, synchronization updates, or destructive actions. Isolation decisions must balance preservation with operational risk. Disconnecting a device may prevent remote tampering but may also destroy volatile evidence, interrupt a critical service, or activate a failsafe. Network isolation, account suspension, or selective blocking should therefore be coordinated with incident leadership and system owners.

Volatile Evidence and Memory Capture

Volatile evidence can be decisive in incidents involving malware, credential theft, fileless execution, encryption, or active network access. RAM may contain running process information, injected code, command-line arguments, decrypted content, session tokens, cryptographic keys, and remnants of network communications. Once power is removed, much of this information is lost.

Memory acquisition is normally performed on a live system using a trusted collector. The collector itself consumes memory, creates processes, and may modify kernel structures or event logs. The objective is not zero alteration—usually impossible—but controlled, understood, and documented alteration.

A sound memory-capture procedure includes:

• recording the system state before execution;
• using a validated tool compatible with the operating system and architecture;
• storing output on an approved destination with adequate capacity;
• recording tool version, command parameters, time, errors, and output path;
• hashing the capture immediately after acquisition;
• preserving the original capture and analyzing a copy.

Memory images should be interpreted with awareness of operating-system version, symbol requirements, address-space structures, virtualization, and possible anti-forensic manipulation. A memory image is not a perfect representation of every byte that existed in RAM; capture methods may omit inaccessible regions or produce inconsistent views during active system changes.

Other volatile artifacts include the process table, loaded modules, open files, logged-in users, routing table, ARP cache, active sockets, DNS cache, scheduled tasks, command history, clipboard contents, mounted volumes, and system uptime. The order in which these are collected matters. A command that enumerates processes may itself create a process and change timestamps. Live response should therefore use a scripted, minimal, recorded sequence rather than unplanned exploration.

Write Protection and Controlled Access

Write protection is a technical and procedural control. A hardware write blocker prevents or rejects write commands at the interface level and is generally preferred for original storage media. Software write protection can be useful but must be tested because operating systems, drivers, adapters, or misconfiguration may bypass the intended control.

Write blockers should be validated with known test media before use and checked for compatibility with the interface involved, such as SATA, USB, NVMe, or specialized mobile-storage connections. A blocker that works for one interface is not automatically reliable for another. The investigator should document model, firmware where relevant, validation date, and test result.

Write protection does not eliminate all risks. A source may contain self-modifying firmware, damaged sectors, hardware encryption, or a controller that behaves unexpectedly. Further, examining a mounted image in read-write mode can alter the image even if the original device was protected. Images should therefore be mounted read-only, and examination should occur on verified working copies.

Hashing, Verification, and Reproducibility

Cryptographic hashes support integrity verification. The hash of the source, image, exported file, or memory capture can be calculated at acquisition and recalculated later. If the values match, the object has not changed in the manner detectable by that hash function. Modern workflows commonly use a strong contemporary hash, sometimes alongside another digest for compatibility or independent verification.

Hashing must be interpreted correctly. A matching hash does not establish that the correct device was selected, that the acquisition was complete, or that the source itself was unaltered before collection. Verification should therefore combine hashes with device identifiers, acquisition logs, tool records, photographs, and chain-of-custody documentation.

Reproducibility requires that another competent examiner can understand and, where possible, repeat the acquisition. Records should include software name and version, operating system, hardware, configuration, command syntax, image format, destination, time source, error messages, and validation results. Automated forensic platforms can simplify documentation, but automation does not remove the need for review.

Live Response and Remote Collection

Live response is appropriate when volatile evidence is important, when encryption makes offline access impractical, or when shutting down the system would cause unacceptable operational harm. It should be narrowly scoped and planned. A response package may collect system identity, operating-system details, user sessions, processes, services, network state, persistence locations, selected logs, and memory.

Remote collection extends these methods across an enterprise. Endpoint detection and response platforms, secure management agents, forensic collectors, and cloud APIs may obtain evidence without physically seizing every device. Remote methods offer speed and scale, but they introduce dependency on agent integrity, network availability, administrator privileges, time synchronization, API behavior, and provider retention policies.

Remote collection should authenticate the collector and destination, use encrypted transport, record the endpoint identity, preserve server-side audit logs, and protect collected data against alteration. Investigators should distinguish between data returned by an application interface and a forensic image of underlying storage. A cloud export may be authoritative for a particular account or service while still excluding provider-side metadata, deleted objects, other tenants, or infrastructure logs.

The principle of least collection is especially important in remote and cloud environments. A broad search across employee mailboxes or personal files may expose privileged, confidential, or irrelevant information. Filters, date ranges, custodians, legal holds, and approval workflows should be applied where appropriate.

Tool Validation and Quality Assurance

A forensic tool should not be trusted merely because it is popular or included in a commercial suite. Validation asks whether the tool performs as expected for the specific operating system, file system, device, and investigative task. Validation may involve known test images, controlled experiments, comparison with independent tools, review of error handling, and examination of output logs.

Tool validation should address:

• supported platforms and file systems;
• handling of bad sectors and interrupted acquisitions;
• treatment of timestamps, deleted data, encryption, and compression;
• hash calculation and verification;
• completeness of memory or logical collection;
• repeatability of results;
• security of stored credentials and transmitted data.

Validation is not a one-time event. Updates can change behavior, and a tool that successfully images a healthy disk may fail on a damaged or unusual device. When a tool reports errors, the investigator should preserve the error information rather than silently repeating the task until a convenient result appears. A second tool or method may be used to corroborate critical findings.

Chain of Custody and Evidence Governance

Chain-of-custody records establish accountability. Each transfer should identify the item, source or evidence number, person releasing it, person receiving it, date and time, purpose, location, and signatures or equivalent electronic authentication. Storage should provide appropriate access control, environmental protection, backup, and monitoring.

Evidence governance extends beyond the forensic laboratory. Organizations should define who may authorize collection, who may access sensitive evidence, how legal holds are applied, how evidence is retained, and when it may be returned or destroyed. Personally identifiable information, health information, trade secrets, privileged communications, and data belonging to uninvolved individuals require special care.

Investigators should separate original evidence, verified master images, working copies, and derived reports. Access to originals should be exceptional and recorded. Reports should identify uncertainty and limitations rather than present interpretations as absolute facts.

Illustrative Case Study: Suspected Credential Theft on an Encrypted Laptop

Background

A financial-services organization detects unusual access to an internal application from an employee laptop. The laptop is located in an office, is powered on, and displays an active user session. Full-disk encryption is enabled. The organization’s incident-response authorization permits collection of corporate data but requires minimization of unrelated personal information.

Situation and Problem

The response team must determine whether malware captured credentials and whether an active remote session remains. Powering off the laptop could remove encryption keys and memory-resident malware. Leaving it connected could permit further exfiltration or remote destruction.

Analysis

The team identifies three competing risks: loss of volatile evidence, continued compromise, and excessive collection. It records the screen, device identifiers, time zone, logged-in account, and network connections. In coordination with the incident commander, the team isolates the endpoint from external network access while preserving the local state needed for memory collection. It does not immediately browse the user’s documents.

Approach

A validated memory-capture tool is executed from approved media. The team records the command, tool version, output location, start and end times, and any errors. It collects process and network information using a documented live-response script, then calculates hashes for the outputs. Because encryption is active, the team performs a controlled shutdown only after volatile collection is complete. The storage device is subsequently acquired through a validated write blocker, and the image is verified.

The analysis is conducted on working copies. Memory examination identifies a suspicious process and an active connection associated with an unauthorized remote-access utility. The disk image supplies persistence artifacts and relevant logs. The team filters unrelated personal files from the review and preserves only material within the authorized scope.

Outcome

The organization can explain why live collection preceded shutdown, identify the data captured, show that the storage image was acquired without writes, and demonstrate that the evidence remained unchanged after acquisition. The technical findings support credential reset, removal of persistence, and broader review of similarly configured endpoints.

Learning Points

The case illustrates that acquisition order depends on system state and evidentiary risk. It also demonstrates that network isolation, memory capture, disk imaging, documentation, and privacy minimization must be coordinated rather than treated as separate activities.

Challenges, Errors, and Limitations

Several recurring mistakes weaken otherwise competent investigations. Collecting volatile data after shutdown is a common irreversible error. Another is connecting an original drive directly to a normal computer without write protection. Selecting the wrong disk, failing to verify device identifiers, or storing an image on an unreliable destination can invalidate an acquisition.

Investigators may also overstate what a hash proves, confuse a logical export with a complete image, ignore tool errors, or use an unvalidated script downloaded during the incident. Poor time documentation can make event reconstruction difficult, especially when systems use different time zones or inaccurate clocks. Remote collection can fail silently because of agent outages, permissions, API limits, or endpoint sleep states.

Anti-forensic activity presents an additional limitation. Attackers may delete logs, manipulate timestamps, encrypt data, disable agents, or tamper with memory structures. Absence of evidence is therefore not always evidence that an event did not occur. Findings should distinguish observed facts, reasonable inferences, and unresolved possibilities.

Ethical, Legal, and Professional Considerations

Evidence collection must be authorized, proportionate, and consistent with applicable law, organizational policy, contractual duties, and professional codes. Authorization should identify systems, accounts, time periods, data categories, and permitted techniques. Cross-border cloud collection may involve conflicting legal requirements and provider policies.

Privacy requires particular attention during live and remote collection. A memory image may contain passwords, private messages, medical information, and data belonging to unrelated persons. Access should be restricted, searches should be scoped, and sensitive material should be segregated or handled under appropriate privilege and review procedures.

Professional integrity requires accurate reporting. Investigators must not conceal failed acquisitions, omit inconvenient errors, exaggerate certainty, or alter evidence to make analysis easier. If a method changes system state, that fact should be reported. Competence also includes recognizing when specialist assistance is needed for damaged storage, mobile devices, cloud platforms, industrial systems, or malware analysis.

Emerging Developments

Modern investigations increasingly combine endpoint telemetry, cloud audit records, identity-provider logs, memory capture, and traditional disk images. Remote acquisition platforms improve speed but increase dependence on centralized agents and provider controls. Virtual machines and containers require attention to snapshots, ephemeral storage, orchestration logs, and host-level evidence.

Automation can prioritize endpoints, calculate hashes, generate collection manifests, and detect missing artifacts. Machine-learning systems may help identify anomalous processes or rank relevant files, but automated prioritization is not a substitute for preservation or expert review. Investigators must understand training limitations, false positives, explainability, and the risk that automated systems discard evidence judged irrelevant too early.

The growing use of hardware-backed encryption, secure boot, confidential computing, and privacy-enhancing architectures may reduce access to traditional artifacts. At the same time, identity logs, cloud control-plane records, endpoint telemetry, and service-provider evidence are becoming more important. The durable principle remains the same: preserve what is at risk, document what was done, verify what was acquired, and state the limits of what the evidence can establish.

Best-Practice Workflow

A defensible workflow can be summarized as follows:

1. Confirm authority, scope, safety requirements, and investigative objectives.

2. Stabilize the scene and document device state, connections, identifiers, and time information.

3. Assess volatility, encryption, remote access, operational importance, and risk of tampering.

4. Choose live, offline, physical, logical, or remote acquisition—or a justified combination.

5. Use validated tools, write protection, controlled media, and secure destinations.

6. Capture volatile evidence before actions likely to destroy it.

7. Calculate and record hashes, tool details, errors, and acquisition times.

8. Preserve originals and analyze verified working copies.

9. Maintain chain of custody and restrict access according to sensitivity.

10. Report scope, methods, alterations, limitations, and conclusions with appropriate confidence.

Chapter Summary

Evidence acquisition is a reasoned process governed by volatility, integrity, relevance, authority, and operational risk. Persistent storage is commonly acquired through physical imaging with write protection, while logical acquisition is appropriate when scope, access, or infrastructure makes full imaging unsuitable. Volatile evidence—including memory, processes, connections, and encryption material—may require carefully controlled live response before shutdown or isolation.

Hashes, tool validation, acquisition logs, device identifiers, and chain-of-custody records support defensibility, but none is sufficient alone. Remote and cloud collection provide speed and scale while introducing dependencies on agents, APIs, permissions, provider retention, and privacy controls. The investigator’s task is not to claim that no change occurred, but to minimize, understand, document, and disclose changes. Ethical and professional practice requires authorization, proportionality, confidentiality, accurate reporting, and transparent limitations.

Key Terms

Volatile evidence: Data that can disappear or change when power is removed or system activity continues.

Persistent evidence: Data retained on non-volatile storage or service infrastructure after shutdown.

Physical acquisition: Collection representing underlying storage media, including areas not normally visible to users.

Logical acquisition: Collection of selected files, records, or application data through an operating system or service interface.

Forensic image: A documented bit-stream or structured representation of a source medium.

Write blocker: A hardware or software control intended to prevent writes to an evidence source.

Memory capture: Acquisition of volatile contents of system memory for later analysis.

Live response: Evidence collection performed while a system remains powered and operational.

Remote collection: Acquisition performed across a network using authorized agents, tools, or service APIs.

Hash value: A fixed-length digest used to help verify that data has not changed.

Chain of custody: A chronological record of evidence possession, transfer, access, and storage.

Working copy: A verified duplicate used for examination instead of the protected original.

Metadata: Information describing an item, such as timestamps, size, ownership, or collection attributes.

Tool validation: Testing whether a forensic tool performs reliably for a defined environment and task.

Evidence alteration: Any change caused by system activity, collection, handling, or analysis.

Volatility prioritization: Ordering collection according to how quickly evidence may disappear or change.

Logical export: Data supplied by an application or platform rather than a complete underlying storage image.

Proportionality: Limiting collection and examination to what is justified by the investigative purpose.

Review Questions

Short Answer Questions

1. Why is volatile evidence usually collected before shutdown?

2. What is the principal purpose of a write blocker?

3. What does a hash verify, and what does it not prove?

4. Distinguish physical acquisition from logical acquisition.

5. Identify four items that should appear in an acquisition record.

Long Answer Questions

1. Explain how an investigator should decide between live and offline acquisition.

2. Describe a defensible workflow for imaging a storage device.

3. Discuss the benefits and limitations of memory capture.

4. Explain why tool validation and error documentation are essential to forensic reliability.

5. Examine the privacy, legal, and governance issues involved in remote collection.

Analytical / Application Questions

1. A powered-on laptop uses full-disk encryption and shows suspicious network activity. Design an acquisition plan that balances volatile evidence, network containment, and privacy.

2. A logical cloud export contains relevant emails, but the provider cannot supply deleted objects or infrastructure logs. Evaluate what conclusions can safely be drawn and what additional evidence should be sought.

3. An investigator discovers that a disk was connected without a write blocker but claims that the image hash matches the source hash. Assess the defensibility of the acquisition and recommend corrective actions.

22. Multiple Choice Questions with Answers

Question 1

Which consideration most strongly supports collecting memory before shutting down an encrypted laptop?

A. Memory always contains a complete copy of the disk

B. Encryption keys and active processes may be lost at shutdown

C. Shutdown automatically changes all disk sectors

D. Memory capture prevents every form of evidence alteration

Correct Answer: B. Encryption keys and active processes may be lost at shutdown

Question 2

What is the primary function of a hardware write blocker?

A. To encrypt the forensic image

B. To prevent unauthorized writes to the source medium

C. To recover all deleted files

D. To synchronize system clocks

Correct Answer: B. To prevent unauthorized writes to the source medium

Question 3

A matching hash between an acquired image and its later verification primarily demonstrates that:

A. The correct device was selected

B. The image has not changed since hashing

C. The acquisition captured every deleted file

D. The source was clean before acquisition

Correct Answer: B. The image has not changed since hashing

Question 4

Which acquisition method is most likely to include unallocated space and deleted-data remnants?

A. Targeted logical export

B. Physical imaging

C. Screenshot collection

D. Clipboard collection

Correct Answer: B. Physical imaging

Question 5

An investigator wants to collect evidence from 2,000 remote endpoints. Which issue is especially important for defensibility?

A. Using an undocumented script on every endpoint

B. Relying only on user statements

C. Recording endpoint identity, agent details, transport, and collection logs

D. Avoiding hashes because remote data cannot be verified

Correct Answer: C. Recording endpoint identity, agent details, transport, and collection logs

Question 6

Why should forensic analysis normally be performed on a working copy?

A. The working copy contains more data than the original

B. It protects the acquired master from routine modification

C. It eliminates the need for chain-of-custody records

D. It guarantees that deleted files can be recovered

Correct Answer: B. It protects the acquired master from routine modification

Question 7

Which statement best describes a limitation of logical acquisition?

A. It can never collect application data

B. It may omit deleted material and areas outside the logical view

C. It always alters the original storage device

D. It cannot be used in cloud investigations

Correct Answer: B. It may omit deleted material and areas outside the logical view

Question 8

A forensic tool reports bad-sector errors during imaging. What is the most defensible action?

A. Ignore the errors if the image opens

B. Repeat the acquisition until no errors appear and discard earlier logs

C. Record the errors, preserve logs, and assess alternative methods

D. Modify the source to make imaging easier

Correct Answer: C. Record the errors, preserve logs, and assess alternative methods

Question 9

Which statement about a hash is most accurate?

A. It proves that the investigator’s interpretation is correct

B. It proves that no change occurred before acquisition

C. It helps detect changes to the hashed object after calculation

D. It replaces device identification and chain of custody

Correct Answer: C. It helps detect changes to the hashed object after calculation

Question 10

During live response, why should commands and actions be minimized and documented?

A. Every live system is legally inadmissible

B. System interaction can alter processes, logs, timestamps, and other evidence

C. Documentation prevents memory capture

D. Minimal action guarantees zero alteration

Correct Answer: B. System interaction can alter processes, logs, timestamps, and other evidence