Documenting everything in a investigation involving how data was acquired and what was done.
Acquisition
- Date and time of collection
- Location of data
- Local timezone (And later time normalization to Greenwich Median Time)
Documenting everything in a investigation involving how data was acquired and what was done.