In any criminal investigation, tamper evident bags are used to collect evidence. In the UK, these bags have to meet specific government regulations in order to be admissible as evidence in court. In line with this, the UK government has published a good practice guide detailing how to use tamper evident bags (TEBs) correctly.
Forensic investigations normally take place within the framework of an incident and thus follow a common cycle of events. You suspect that an employee has found a way of intercepting emails from one of their colleagues. What would the incident lifecycle look like?
PhotoRec is an open-source application that aims to recover media files (photos, videos and documents) from drives even after they have been deleted and removed. Despite What many user may think, files are hardly ever truly deleted.