Legal vs. internal corporate purposes

Forensic process

 Identification

 Evidence collection

  Chain of custody

  Order of volatility

   Memory snapshots

   Images

  Cloning

 Evidence preservation

  Secure storage

  Backups

 Analysis

  Forensics tools

 Verification

 Presentation

Integrity preservation

 Hashing

Cryptanalysis

Steganalysis