Do's and Don’ts for Digital Evidence

One Friday afternoon, the information technology director of a major telecommunications provider (we’ll call him Jim) rushed up to the office of the company’s president (whom we’ll call Tom). Jim was carrying a corporate notebook computer that had previously been used by an employee who had just been terminated. Jim quickly related to Tom that while reconfiguring the computer—standard procedure before reissuing it to another employee—the IT staff had found what appeared to be child pornography on it.