Computer Evidence Processing Guidlines

The foundation of all Forensic practice is in practicing, maintaining and protecting integrity and continuity of evidence as it establishes credibility and reliability in court and makes certain that any fabrication, misunderstanding, bias’s or even mistakes, have not occurred.

Preserve Physical Evidence: Collect any physical items you have that might relate to the alleged incident or the accuser. This includes any photos or videos, as well as evidence like clothing and other objects they may have touched, including cell phones and computers. As much as possible, you should avoid manipulating these items any further or doing anything that could potentially destroy physical evidence.

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

When speaking about procedures for packaging, transporting, and storing evidence. I have noticed that there is a general practice of how this should be performed as to the best way to maintain the integrity of the evidence. However, within this general practice, procedures vary slightly from department to department.

The United States Supreme Courts ruled (Daubert versus Merrell Dow Pharmaceuticals, Inc.) that digital forensic tools used during a forensic examination must have validation for the results of the examination to be upheld in court. This means that any tool or technique used during the forensic analysis of evidence must be validated through the process of the scientific method. There are three important issues in regards to computer forensics: admissibility of evidence, standards (certifications), and the analysis (preservation) of evidence. The term “Validation” refers to the confirmation by examination and the provision of objective evidence that the requirements for a specific use are fulfilled whereas the term “Verification” refers to the confirmation of validation with tools, techniques, and procedures (Flandrin).

Supportive investigation procedures and protocols should be in place in order to show that the incriminating evidence was on the electronic media. Crime has changed since the dawning of the computer age and the need for digital forensics is growing rapidly. Digital forensics has various areas based on different standards and media types, each with experts. There have been major breakthroughs in digital forensics

The laws of evidence are crucial in both governing and administrating justice. They have been carefully developed through many different statutory obligations and also developed through the common law. It can be argued that the main aims of evidence are to fairly and justly seek the truth to a crime, and if the court finds so, prosecute the accused. However, it can be noted that in both criminal and civil crimes, the laws of evidence are centred around protecting the accused of misconduct, with commonly the

This manual is to assist forensic technicians who may be responsible for preserving electronic crime scene and recognizing, collecting, preserving, and storing digital evidence. When dealing with digital evidence, these principles apply: The process of collecting, securing, and transporting digital evidence should not change the evidence in anyway. Only trained forensic technicians specifically for digital evidence should conduct the analysis. Everything done during the search, seizure, transportation and the storage of the digital evidence should be documented, preserved and ready for review.

Acquisition. Due to digital evidence’s fragile state, investigators should be aware that it is easily altered, damaged, or deleted by improper handling of the evidence. Examination best practices are conducted on a copy of the original evidence. The original evidence should be secured in a way that would protect a preserve the evidence in its original unaltered state.

An extremely important computer forensic service is the preservation of evidence. In this step a forensic image is made of all pertinent data. This image is actually what is being analyzed and the original source where the data was extracted is put in a safe and confidential environment. The security and authenticity of this information is analyzed very carefully and handled only by a digital forensics expert.

(3)http://www.aicpa.org/Research/Standards/Pages/default.aspx Golden, T. W., Skalak, S. L., Clayton, M. M., & Ebooks Corporation. (2006). A guide to forensic

Dedicated system forensics specialists have trained intensively in investigating digital incidents to determine magnitude of the situation. Since digital crimes are committed on devices over multiple computing platforms, it is essential for forensic specialist to have a broad knowledge on which tools and techniques yield best results. The information collected from devices may serve as useful evidence in a legal matter; you never want the gathering of data to be an issue during the trial proceedings. Dedicated system forensic specialists understand the advantage in preparing a chain of custody report; it documents who oversaw data recovery or imaging, when & where collection took place and how & who stored data, which all add evidentiary value to findings. Individuals not skilled in the digital investigative process may inadvertently contaminate, overlook or destroy evidences, or simply forget to document the collection process. The smallest omission & fallacy in evidence collection or documentation can cause finds to

The revised regulation 26 (f) wanted social groups involved to converge early in the conduction of lawsuit process and brainstorm about issues relating to Electronically Stored Information discovery, and the strategies put in place. A talented person to take care of it is required, also the judges should be fully equipped with the relevant materials to defend their culprit. Grouping information as protected and listing it for peruse and recovery is information control step. Being aware of where data is kept and processed will not only help in keeping reduced cost but will also give an advantage of providing some surety when tackling the initial questions asked. It is of paramount importance that what is asked in early stages be given sure answers (Adler, 2007).

Digital forensics is almost like observing someone’s complete psyche, you see that person likes and dislike. You are viewing their hates and love; you are finding things they don’t want to share with anyone else in the entire world. Using digital forensics is extremely perplexing with the obligation of interpreting the digital forensics that are located in an investigation.

In any case, during the initial canvass of the crime scene, documentation is made to identify where evidence is and the type of evidence found. After it is recorded in an evidence log the collection of evidence can begin. You will want to start with collecting “the most fragile or most easily lost evidence” (Shiro, n.d.). Throughout the collection process you will want to keep evidence in order by documenting in the log where it is and taking photographs of each item. If additional items are found underneath the other evidence, this should be documented in the log and “photographs should also continue to be taken if the investigator is revealing layers of evidence which were not previously documented because they were hidden from sight” (Shiro,