Preserving Evidence - Disk Drives

Where possible, preserve the original disk drives and proceed with recovery using backup drives or restored drives.
High value systems should have mirror / backup drives and routine backups or backup systems.
Perform analysis on images made from drives, not on the original drives themselves.
Insure, and document, that the drives are not altered by any analytical process.
Never write to the drives unless it is necessary for the analysis and then document everything!

Where possible, preserve the original disk drives and proceed with recovery using backup drives or restored drives.