Describe the process on how you acquired the evidence, and the methods you used to prove the evidence is authentic and not modified during the acquisition process (for example was there a chain of custody). The Acquisition process involves 2 steps: 1 Duplication: State the forensic method used. For example, if there was duplication of the digital evidence, state if write blocking was used by a physical hardware device or software to copy the original digital evidence by removing the hard drive from the computer. 2 Verification: Discuss if the forensic tools that analyzed the data were valid. It is typical to see some form of data validation, for example MD5/ SHA1 values for the evidence collected. Here you want to show the evidence will be admissible to court, and by the method you used to verify the evidence presented, the evidence is the same as the original evidence collected.