  The collection and handling of court admissible evidence is a fundamental
component of any digital forensic investigation. While the procedures for
handling digital evidence take much of their influence from the established
policies for the collection of physical evidence, due to the obvious
differences in dealing with non-physical evidence, a number of extra policies
and procedures are required. This paper compares and contrasts some of the
existing digital evidence formats or "bags" and analyses them for their
compatibility with evidence gathered from a network source. A new digital
extended evidence bag is proposed to specifically deal with evidence gathered
from P2P networks, incorporating the network byte stream and on-the-fly
metadata generation to aid in expedited identification and analysis.
