Correct handling of volatile data to ensure evidence is acquired without altering the original.[29] If a Trojan is found, it is necessary to examine the totality of the circumstances and the quantity of incriminating materials. Including a "network forensic approach" e.g. by way of legally obtained packet capture information.[30]