The development of a computer forensic response capability can be a useful campus resource. This session will discuss the proper way to preserve fragile digital evidence and common evidence analysis techniques and tools, all framed with real-life incidents where possible.