No matter how a computer is used as part of a criminal offense, it is the information that is stored on that computer that becomes important to the law enforcement investigator. A skilled investigator can find evidence on computer media, despite a suspect's efforts to erase it. This article explains why and how computer data that a suspect erased can be retrieved as it was initially entered onto the computer hard drive. Law enforcement personnel must not only be trained in how to preserve and secure evidence in a computer, they must also know how to process and present it in court so that it complies with the rules of evidence. Admitting computer evidence can be likened to introducing a letter that contains a confession that purports to be written by the suspect. Before the letter can be introduced into court as evidence, it must be shown that the letter's author is indeed the suspect. Similarly, before computer data can be introduced as evidence, a foundation as to the recovery of that evidence needs to be clearly established. There are three absolutes for law enforcement professionals who handle computer evidence: Be certain that no changes have been made to the information; take precautions while gathering evidence; and be able to testify technically about the integrity of the evidence. The keys to taking advantage of evidence contained in a computer are adequate training of investigators and the appropriate use of automated electronic collection products.