Computer forensics examiners analyze digital evidence that can be utilised in investigations.  They may possibly respond to crime scenes, take photographs, record evidence, and take into custody physical evidence such as computers, keyboards, cables, and other equipment.  This consists of the securing of USB flash drives, disc drives, and other information storage devices.

In a criminal investigation, when computer forensics teams arrive to a crime scene, they first capture any volatile data in RAM that would be lost when a computer is turned off.  The captured information is moved to a secure location for preservation.  Captured data might include images, open documents, network configurations, present network connections, contents of RAM, and logon sessions.  Pc forensics examiners may possibly also focus on gathering the evidence from the challenging drive.  They can obtain a mirror image back up, which is an evidence-grade backup that meets legal evidence standards. 

When a computer forensics team is at a crime scene, it need to also commence and preserve a strict chain of custody of all digital evidence recovered.  Laptop or computer forensics experts ought to document all serial numbers of the items involved, who handled the evidence and any related data for it to be admissible in court.  The chain of custody must also document that no unauthorized person was allowed access to the evidence.

As soon as the information the examiners gather the data obtained at a secure location, they examine the evidence and write a report on the findings.  The evidence and report might be employed in a court of law to prosecute a criminal case.  Pc forensics specialists could also present written, video, or live testimony of their investigation and findings for court proceedings.