Forensic appraisals are a special case, which is used in both official and private appraisals. In computer forensics or digital forensics, IT systems are examined, digital traces are evaluated and saved. Possible applications could be
The forensic worker's work begins with the first access to the IT systems to be examined (for example during a house search). Grade at this
the first important point often dispenses with the presence of an expert, which leads to serious errors and
which complicate a subsequent investigation of the hardware or even thwart. Thus turning off a computer may result in e.g.
no longer can be accessed on encrypted volumes, or deletion routines are triggered, the important pieces of evidence
destroy. Also, the memory of a computer can still contain important evidence that must be backed up on the first access. Therefore
the expert secures the RAM of a running computer at the first access and checks, if necessary.
encrypted data carriers are integrated, which must be secured before turning off the computer, so that a complete
evaluation is possible.