1. First, the subject is legal, that is, the electronic data forensics work must be led by investigators and assisted by relevant technicians. Second, the procedure is legal, that is, electronic data evidence should be collected, stored, transmitted and presented according to law, and the time, place, producer, production process and equipment of the evidence should be specified, and it should be equipped if necessary.

Witness. Third, the source is legal, that is, the legality of obtaining the storage media and equipment attached to electronic data.

2. The principle of timeliness. Because of the uniqueness of electronic data, it is difficult to recover once it is lost, and the requirement of timely evidence collection is particularly prominent in the process of electronic data collection.

3. The principle of comprehensiveness. The process of electronic data forensics must be all-directional, multi-angle and multi-level, and any electronic data related to the facts of the case should not be omitted due to negligence, so as to confirm each other, eliminate contradictions and form a complete evidence chain.

4. Professional principles. Electronic data based on computer and information technology cannot rely entirely on tradition.

Criminal evidence collection technology, in order to ensure the probative power of electronic data evidence, should be led by investigators, with the help of special equipment and technical means, and professional technicians should follow a series of professional operating norms to extract and fix relevant electronic data.

5. The principle of no loss. In the process of collecting and fixing electronic data, improper operation should be avoided, and the consistency between the equipment involved and the operating environment should always be ensured. The storage medium should be far away from magnetic field, high temperature, dust and humid environment to avoid the loss of electromagnetic medium data and ensure the lossless state of electronic data.