This chapter discusses what constitutes digital evidence, the collection and analysis of digital evidence, chain of custody, the writing of the report, and the possible appearance in court as an expert witness. We give an in-depth discussion of digital evidence acquisition rule of thumb and the candidates for evidence extraction. On preserving of evidence, a cornerstone of crime investigation, we note that since digital evidence is very fluid, in that it can disappear or change so fast, extra care must be taken in preserving digital evidence. We discuss the various techniques to preserve evidence and what needs to be done if evidence is to be moved. We stress the importance of careful analysis of digital evidence noting that this process is the most difficult and most opinionated. It is also the most important, most time-consuming, and painstakingly slow and should be thorough so that it can support or reject a fact based on identified patterns of activities, file signature anomalies, unusual behaviors, file transfers, and several other trends in the evidence. Final issues discussed in this chapter include the process of report writing and presentation and also the ethical implications and responsibilities of both the investigator and the lawyer. The role of the investigator, as the main player in the process, is discussed in depth in light of the absence of a legal and ethical framework for digital forensics investigators to work under. Specific guidelines like the United Kingdom Association of Chief Police Officers (ACPO)’s “Good Practice Guide for Computer Based Electronic Evidence” and the US National Institute of Standards and Technology (NIST) 800 series special publications are suggested.