all right now, we talked about working in order of most volatile, to least volatile. And then another element of final element to be concerned with in forensics is making sure that we can guarantee the integrity of evidence. So they're just some basic principles again. This just
forensics, You know, more traditional forms. This is relevant as well.
Avoid handling the evidence if you can in hand with this little is possible. The more times I handle that evidence, the more touches it has. The more likely modification is Tau Tau happen or att least the possibility of modification. And remember, even that possibility gives us the reasonable doubt,
our work on copies rather than the originals. That's how you keep from handling the originals. You make copies. And when we're looking at things like hard drives, for instance that we want to analyze, we're gonna put those hard drives in right protected systems before we even make a copy.
You know, right is the first thing that we do is analysis well, with examination of the hard drive,
we start by putting that hard drive in a right protected system. There are many things we have to do before powering down the system and getting the hard drive out. But once that stage has begun, we want to make sure it's in a right protected system and then hashes hashes guarantee integrity.
And we're not gonna go into all the details of hashing that was in your C I s s P course and how
hashes work. But ultimately that's gonna provide the proof that our drives have not been modified so really important to guarantee the integrity of evidence.