- Follow RFC3227. In case you violate it, you must have a good reason.
- To save time collect only QuickWin artifacts to AD1 container using FTKImager
- Collect device details and Hardware information before acquisition
- Connect device to stable power source and disable sleep options before acquisition
- Wipe & validate your Destinations media
- Do not rely on one tool
- Understand every tool you are using