The Forensics Mindset & Chain of Custody

1.1 The Ethical Core

A forensic examiner is not an advocate for the prosecution or the defense. You are an advocate for the truth. This requires a fundamental commitment to objectivity and the scientific method.

The Locard Principle

"Whenever two objects come into contact with one another, there is exchange of materials between them."

In digital terms, every file opened, every network packet sent, and every keystroke modifies the system in a traceable way.