Why should you protect or safeguard evidence until a computer forensic expert arrives?
In criminal law there is something known as “the chain of evidence.” If a computer is suspected of being involved, it is important that the computer (and by extension – anything contained on the drives) be preserved for recovery by technicians to be investigated and preserved for use by the prosecution. It is generally not necessary for a computer forensics technician to respond to the scene – it would be sufficient to take the computer into custody as evidence and securely store it in an evidence locker for later examination.
