2: This week's live session taught us more about forensic evidence procedures and documentation. One of the most important things to always remember is document, document, document. Effective data analysis relies on a blend of procedure and technology. We watched a video explaining how when a computer system is attacked, our first thought is about how to solve the problem. However, this is only the beginning for someone in digital forensics. Digital forensics consists of a process that includes identifying, preserving, analyzing, and presenting digital evidence. Digital forensics has vastly evolved since the 1980s to keep up with the rise of criminal activity involving computers. A new landscape for criminal activity emerged during this time. Digital forensics has become vital in dealing with computer-based crimes such as cyberstalking, human exploitation, and cyber-terrorism. In addition to computer-facilitated crimes such as data breaches and theft of sensitive information. Specialized tools are now used to capture, analyze, and preserve this information to be used as evidence in court. Forensic analysts must follow an 8-step scientific process when collecting digital evidence. This process covers the procedures for collecting and examining evidence to be used in court. Using this scientific process to collect and preserve evidence increases the likelihood that it will be admissible in court. When a computer has been breached, digital forensics ensures best practices are observed throughout the evidence-gathering process. These tools provide a means to bring cybercriminals to justice. When a crime is committed, law enforcement should go to the scene with all the tools and procedures necessary to recover information used at trial. Additional tools may include new storage media for imaging hardware, techniques for bypassing word-protected information, and software to examine a hard drive containing deleted or compressed information. Report preparation is also an essential critical step in the investigation process. The information gathered needs to be edited into a format that details the steps used because the evidence will ultimately face judicial scrutiny. The information must also be refitted into a format for easy, effective review. The writer must note the procedures used to document the chain of custody by logging all activities. This establishes the value of the information used as evidence. We then watched a video on how to prepare for testifying in court and how necessary the preparation and rehearsal with the attorneys is to the court testimony. Lastly, we learned about future trends, such as the need for establishing technology-neutral legislation and establishing accountability for internet users. This also includes increasing public awareness and research capabilities, interagency, interdepartmental, and international cooperation, standardization of accreditation or expertise, increasing the use of forfeiture statutes, and staying current on innovations involving wireless communications