The goal of this project is to develop a working defition of how to collect digital evidence in a forensically sound manner. Existing definitions and guidelines for this type of activity were developed with a very narrow scope, too narrow to fit many of the scenarios where digital forensics and incident response are utilized. For example, the existing defintions do not apply well to the scenario when a forensic examiner and/or incident handler is attempting to collect digital evidence from a running system. In addition, the existing defintions do not cover how to properly collect network based evidence for network forensics, nor do they cover how to properlly collect code based evidence for code analysis.

There has been some discussion about this topic at the following locations:
http://forensiccomputing.blogspot.com/2006/08/forensically-sound-duplicate.html
http://taosecurity.blogspot.com/2006/08/forensically-sound-evidence.html
http://windowsir.blogspot.com/2006/08/what-is-forensically-sound.html