Methodical approaches for collecting and preserving evidence of computer crimes. Foundational concepts such as file system structures, MAC times, and network protocols; tools for extracting evidence; general legal issues.