Short Paper - Forensic Computer Evidence

Based on the material from the "U.S. Department of Justice Forensic Examination of Digital Evidence: A Guide for Law Enforcement" document (attached), explain some important parts of the computer forensic process.

Provide short and concise answers to the following questions:

1. What are some of the key considerations for an "on-site" examiner, also known as a "first responder"?
2. What are two attributes of a timestamp that could be located on a computer system? (List and explain.)
3. When documenting and reporting a computer forensic examination (investigation), what are some common notes that should be maintained? (List and explain.)
4. What are the four major steps to completing the processing of digital evidence?