Evidence Collection and Archiving (RFC 3227)

If evidence collection is done correctly, it is much more useful in apprehending the attacker, and stands a much greater chance of bein admissible in the event of a prosecution. - http://www.ietf.org