Blue Dragon are from time to time asked to not merely do a forensic collection of data, but to conduct forensic analysis. This involves a consideration of deleted data, USB history, web browsing history, webmail access and main other points of behaviour on the computer, laptop, server or phone.
Digital evidence is by its very nature fragile and easily altered. It must be collected in such a way as to maintain metadata evidence, and the evidence should not be examined first by the client or the client's IT manager as this may taint its value as evidence. It is also often important to preserve evidence so that behaviour on the device or computer can also be examined, not merely the files themselves, but file history, deleted data, USB history, internet browsing, programme history, and so on. To record the passage of this vital evidence after collection, it is typical to put in documnent form, with information on the data collected, and to preserve the evidence in a forensic image.