User manual · Chapter 17
Best Practices
Prepare repeatable evidence-collection workflows, reduce contamination, document limitations, and maintain audit readiness.
17.1 Defensible Evidence Collection
Use a consistent workflow:
- Prepare workstation.
- Confirm time synchronization.
- Confirm case and investigator metadata.
- Configure acquisition options.
- Record legal authority or scope externally.
- Capture evidence.
- Review logs and reports.
- Verify hashes.
- Export securely.
17.2 Repeatable Workflows
Repeatability improves credibility. Use templates or standard operating procedures for common collection types:
- Web page screenshot and source.
- Authenticated web session.
- File download.
- Mail capture.
- Network capture.
- Batch URL capture.
Document deviations.
17.3 Minimizing Contamination
To reduce contamination:
- Use a clean VM or workstation.
- Close unrelated applications.
- Use dedicated accounts.
- Avoid personal browser sessions.
- Use Eviquire’s controlled browser profile.
- Do not browse unrelated sites during acquisition.
- Do not manually modify evidence folders.
17.4 Proper Documentation
Eviquire documents technical events automatically, but investigators should still document:
- Legal authority.
- Scope.
- Target identifiers.
- Authentication steps.
- Search terms.
- Observed behavior.
- Limitations.
- External tools.
- Transfer and storage actions.
17.5 Audit Readiness
For audit readiness:
- Preserve original packages.
- Store hashes in case notes.
- Keep reports with packages.
- Maintain access logs.
- Verify timestamp files when needed.
- Document software versions.
- Record any errors or warnings.