Computer Forensics Expert Note: In the field of computer forensics,  The preserving and authentication phase is critical to ensure the admissibility of evidence, should that become necessary.    Perhaps, the most important consideration is that the original evidence must not change the during the acquisition process.  For this reason, the forensic examiner must use forensically sterile new media.  The examiner must also ensure that the forensic copy is an bit-by-bit copy.   To authenticate properly, the examiner must perform three hashes: First hash the original evidence.  Second, hash the clone or forensic bit by bit copy.  Finally, the computer forensics examiner must hash the original (bit by bit copy) of the original evidence to make sure that it was not altered during the acquisition process.

This computer forensics information is presented by AVM Technology, LLC, a Computer Forensics, E-Discovery, and Computer Security consulting company located in Richmond, VA and serving clients throughout the United States.