A digital forensic system for performing forensics on a target device comprises a control pod and a collection device. The control pod, which has a unique identity in order to enable accurate audit, is arranged to register and allocated a unique identity to the collection device and to clean, load a profile onto the collection device, the profile defining a subset of data. The collection device is connected to the target device and copies data from the target device to the collection device according to the profile. The control pod is then arranged to create a report on the collection device, the report derived from the copied data. Once a user input has been received, indicating that the collection device be marked as evidence, then the control pod is arranged to lock the collection device in response to the user input.