Almost every task in an investigation begins with a planning step. Unfortunately, it's human nature to skip the planning and jump right to the task at hand. In Chapter 5, you find out how to avoid the ready-fire-aim approach. Poor planning adds unnecessary risk, delay, and expense to an investigation and can stress you out. Take a tip from construction crews who "measure twice, cut once" — wood can't be uncut. Acquiring e-evidence makes full use of that principle, as you read in Chapter 6. Even when you're improvising, you need to follow a do-no-harm defensive methodology. The safest (least harmful) methodology is one that prepares you for the worst-case scenario. With a lot of unknowns in your case, such as who's involved and the timeframe, you need to know what to consider. If you consider these factors in your planning decisions, you then treat every case like a criminal investigation with the strictest evidence rules.

You prepare to make smart choices that crack the case but not your credibility. You find out how to handle yourself as well as the e-evidence. In Chapter 7, you learn how to examine electronic content to find the evidence relevant to the case. You're the master of this thinking and deductive stage of the investigation process. You perform your work in the style of the famous master of deduction, Sherlock Holmes.

You go head-to-head in Chapter 8 with attempts to stop you from finding e-evidence. You recognize attempts to hide evidence behind passwords, encryptions, and steganography — and how to overcome them.