Title: 1. Identifying Digital Evidence
Course: IN 2005 Digital Forensics > Section: Module 5: Chapter 5 - Processing Crime and Incident Scenes

Identifying Digital Evidence

1. Digital evidence is any information stored or transmitted in digital form.  U.S. courts accept digital evidence as physical evidence, which means that digital data is a tangible object.
2. Some require that all digital evidence be printed out to be presented in court.
3. Some of the general tasks investigators perform when working with digital evidence, including:
  - Identify digital information or artifacts that can be used as evidence
  - Collect, preserve, and document evidence
  - Analyze, identify, and organize evidence
  - Rebuild evidence or repeat a situation to verify that the results can be reproduced reliably
  - Collecting computers and processing a criminal or incident scene must be done systematically.

Understanding Rules of Evidence

1. Consistent practices help verify your work and enhance your credibility. In addition, you should comply with your state’s rules of evidence or with the Federal Rules of Evidence.
2. Mention that evidence admitted in a criminal case can be used in a civil suit, and vice versa.
3. The data you discover from a forensic examination falls under your state’s rules of evidence or the Federal Rules of Evidence.
4. Digital evidence is unlike other physical evidence because it can be changed more easily. The only way to detect these changes is to compare the original data with a duplicate.
5. Most federal courts have interpreted computer records as hearsay evidence. Hearsay is secondhand or indirect evidence, unless it falls under the business-record exception.
6. The business-record exception allows “records of regularly conducted activity,” such as business memos, reports, records, or data compilations. Generally, computer records are considered admissible if they qualify as a business record.
7. Two categories of computer records:
  - Computer-generated records
  - Computer-stored records
8. Computer records must also be shown to be authentic and trustworthy to be admitted into court. Computer-generated records are considered authentic if the program that created the output is functioning correctly.
9. Collecting evidence according to the proper steps of evidence control helps ensure that the computer evidence is authentic.
10. When attorneys challenge digital evidence, often they raise the issue of whether computer-generated records were altered or damaged after they were created.
11. One test to prove that computer-stored records are authentic is to demonstrate that a specific person created the records. For example, the author of a Microsoft Word document can be identified by using file metadata. See Figures 5-1 and 5-2.
12. The process of establishing digital evidence’s trustworthiness originated with written documents and the best evidence rule.
13. The best evidence rule states that to prove the content of a written document, recording, or photograph, ordinarily the original writing, recording, or photograph is required.
14. The Federal Rules of Evidence allow a duplicate instead of originals when it is produced by the same impression as the original.  As long as bit-stream copies of data are created and maintained properly, the copies can be admitted in court, although they aren’t considered best evidence.