"Treat digital evidence with care", says Neil Barrett in this week's IT Week, arguing that we must take greater care to preserve evidence in digital crimes.
Most computer evidence is spoiled within the first few minutes of discovery by careless or well-meaning first responders who don't know much about IT security but who insist on 'simply checking a few details' before the potential crime is passed for investigation.
As a result, timestamps are changed, log files altered, temporary files produced. In short, various changes are made by those who do not understand the scope or extent of those changes. It is like the first person at a murder scene picking up the bloodstained knife and cleaning it to see how sharp it is.
No one would do that, so let's also try to prevent interference with computer evidence.
It might seem harsh, but such blunders are so often the case with computers; indeed, with any incredibly complex technology that is handed over to users with next to no knowledge of them at all.
