1. A method comprising: receiving input from a remote user of a client device that identifies computer evidence to acquire from a target computing device; acquiring the computer evidence from the target computing device with a forensic device coupled to the target computing device via a communication link; storing the computer evidence on the forensic device; and presenting a user interface for the forensic device through which the remote user views and analyzes the computer evidence acquired from the target computing device.