Computer Forensics Tools
In general, a computer forensic investigator will use a tool in order to gather data from a system (e.g. a computer or computer network) without altering the data on that system. This aspect of an investigation, the care taken to avoid altering the original data, is a fundamental principle of computer forensic examination and some of the tools available include functionality specifically designed to uphold this principle. In reality it is not always easy to gather data without altering the system in some way (even the act of shutting a computer down in order to transport it will most likely cause changes to the data on that system) but an experienced investigator will always strive to protect the integrity of the original data whenever possible.
