(Source: International Organization on Computer Evidence)
- In the process of obtaining digital evidence, actions taken should not alter the evidence.
- Where it is necessary for a person to access original digital evidence, that person must be competent in terms of crime.
- All activities related to the investigation, storage, examination or transfer of digital evidence must be fully recorded in writing, kept and available for evaluation.
- A person is responsible for all activities related to digital evidence as long as they are in his possession.
- Any organization responsible for investigating, accessing, storing or transferring digital evidence is responsible for compliance with these principles.