Departure from The Norm

The Computer Forensic Field Triage Process Model may be a bit difficult for some investigators to get use to at first as it is a bit backwards from what they have been taught to do in most investigations. In many cases investigators have been taught never to touch a suspect computer and simply unplug it to prevent any alterations to any evidence on the machine. In cases where time is critical, it may be necessary to depart from the commonly held forensic principals in order to get the evidence in time to make a difference.