As a normal reaction, the change in technology led to a change of possible evidence, as compared to previous traditional evidence. All the components of the computer system could be evidence, such as the following:
The hard drive of the criminal or the victim
The operating system artifacts and special files
The network traffic
The computer memory
Mobile phones and tablets
Cloud storage
Shared storage
Network devices
The systems' logs
The devices' logs
GPS devices
Simply, any device that can store or process data
Due to the wide range of possible evidence, the incident handler or first responder who will handle and process the available devices in the incident scene must have sufficient experience in dealing with whatever types of evidence they may find at the scene.
Handling digital devices is a very significant task, which the whole investigation process relies on. This is considered to be one of the main principal needs that have to be fulfilled in order to conduct successful digital analysis.
