Forensic Data Acquisition

Acquisition by Source

• Drives and devices: The client approves the acquisition level. Data365 Evidence assesses each source and selects the technical method within that scope.
• Cloud systems: The client approves the accounts, data scope, and permitted methods. Data365 Evidence assesses each source and selects the technical method within that scope.
• Public website content: Data365 Evidence assesses the source and selects the capture method within the approved scope.

Acquisition Requirements

• The client approves the scope, authorized sources, permitted methods, and expected deliverables.
• Written approval is required before adding sources, expanding scope, or changing an approved preservation or acquisition method.
• Data365 handles physical devices and media only as necessary for acquisition.
• Data365 records integrity-verification results for acquired images and exports and documents known technical limitations.
• Data365 maintains chain-of-custody records while devices, media, or acquired data remain in its custody.