Revision as of 11:40, 30 April 2006 by Simsong (wow. Didn't raelize that RFC #### was special in mediawiki)
- Data Reduction - By eliminating information that doesn't matter, an investigator is left with information that does matter.
- Locard's exchange principle
- RFC 3227, "Guidelines for Evidence Collection and Archiving," D. Brezinski and T. Killalea, February 2002.