Secondly is to protect and secure the useful promising information that is relevant to the computer. An investigator should ensure that no available evidence are damaged, destroyed, or contaminated, and no possible computer virus is brought in to the suspect computer during the forensic inspection. Information represented by physical items, such as computer hardware and printed files, can be described easily by correctly following traditional physical evidence procedures. The actual challenge comes from acquiring evidence stored in these physical items, such as hard drives, CDs, DVDs, zip disks, or floppy disks. All data residing in the suspect computer’s hard drives and disks need to be protected from any potential evidence and this has
