Applying forensics tools and methods
There will be cases where you will be required by management or the HR department to gather some data from a given computer as evidence because a procedure, policy, law, or regulation has been violated.
Therefore, you need to have a variety of tools at hand that allow you to do this task in the most integral way, first to preserve your neutrality, but also because you may be dealing with evidence that may end up in court. So, let's start by understanding the best practices about how to manage evidence.
Dealing with evidence
When dealing with digital evidence, data integrity is key to demonstrating that the evidence has not been altered in any way.
The best way to achieve this is by using hashes because even the most minimal change will make the hash change. However, if the hash remains the same, then you will be 100% certain that the file hasn't been altered.
As shown in the following screenshot, just making the first letter...
