Forensic Evidence Preservation

The film, Evidence and Forensic: Due Process, highlights the development of evidence used everyday in the criminal justice system. Putting to sleep, stereotypical Hollywood crime shows, by displaying acceptable criminal evidence, then analyzing the evidence, and applying the evidence in court. The program accounts on the important techniques and actions taken by not only law enforcement, but also forensics specialists and lawyers.

Review the information in the text sheet entitled “Overview of Evidence and Digital Forensic Analysis Techniques,” which describes different types of digital forensic analysis techniques, such as disk forensics and e-mail forensics.

It is critical that evidence is collected in the correct manor to ensure that evidence is not destroyed. The investigator who is collecting the evidence should be properly trained in collection of evidence (Cosic, 2011). One example of proper protocol would be if a computer or cell phone is turned on when found, then it should not be turned off to prevent possible destruction of evidence or prompting for a password for access. The collection process can sometimes prove to be the most difficult because it evidence can easily be compromised or even destroyed (Manes,

The crucial step of the investigation is the transport and storage of evidence recovered from the crime scene. Tightly controlled access during transport and storage will prevent any unauthorized contact and possible tampering or loss of evidence. The evidence that is recovered at the scene must reach a forensic laboratory as quickly as possible, appropriate conditions will prevent deterioration of evidence during transport and storage. Evidence might have to be stored for some years until a case goes to court or if the case is unsolved so labelling and storing evidence must be appropriately done to avoid contamination or disintegration etc.

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

Behind every court case there’s a train of forensic science evidence and research. Forensic science is the application of scientific principles of criminal justice. In many court cases a forensic scientists is the one on the scene collecting finger prints, photos, blood samples and other evidence. Unfortunately one of the controversial issues in the forensic world is the evidence and its lack of verification of its reliability. In the field of forensics there are issues in finding proof in generating conclusion, fundamental knowledge to solve problems, and the whole false memory defense in the court. These issues can be solved in many ways like extensive research, preparation and training. These issues

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

Identification: this is identifying the possible containers of computer related evidence, such as hard drives, flash drives, and log files. Meanwhile a computer or the hard drive itself is not evidence but a possible holder of evidence. The information and data to be extracted has to do with the information that is pertinent to the situation in question (Hailey, 2003).

Forensic readiness is a decade old concept that many organizations have taken steps to address and implement. It involves taking steps of preparation in anticipation of a particular type of incident. This includes ensuring adequate logging for monitoring, detection, post-mortem investigation, and event reconstruction. Forensic readiness ensures that adequate staff, training, tools, and external support are all in place in advance. Forensic readiness is becoming a crucial part of risk management, and good incident preparedness helps to increase efficiency, reduce the costs of incident response, and help organizations prioritize resources (Nikkel, 2014).

a. Particular care was taken in the discovery, recovery, preservation and control of electronic data, documents and E-evidence.

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Before the reporting of the actual work done can start, it is important to include a section with the terms of reference. This explains the technical terms that is not generally known and any acronyms it might appear in the report. This is important for any readers that are not familiar with forensic terminology.Next a short background to the investigation must be given for the benefit other readers who are not familiar with the case the case.After the background is given, a section on the mandate must be included. This needs to explain who requested and authorized the investigation.It is also important define the scope of the investigation clearly, so that it is clear that the investigation did not venture outside of the legally authorized scope.The evidence must be clearly identified, inclusive of serial numbers and any other identification that can be used to confirm that it is the same as the evidence that was acquired. Where used, the hash codes for the evidence items should also be included to show

The client is known for taking these types of incidents to court for prosecution to the full extent of the law, so it is imperative that the investigation follows all procedures for documentation, digital evidence collection, and digital evidence storage required to ensure admissibility in court. Furthermore, XYZ, Inc. has been given four tasks that must be completed to ensure a clear and concise plan has been developed. This plan would then be implemented for utilization into the

Having been briefed on the nature of the incident, the forensic investigator will conduct interviews of the database (DB), Email, and network administrators to determine what she knows about the chain of events leading up to the receipt and subsequent

Properly handling evidence is critical to crime solving, improper deviations to the handling can make it impossible to prosecute using the evidence collected. This paper will outline will track the evidence from a chosen crime scene through all the proper handling processes. This paper will describe the chosen crime scene scenario, describe the collected evidence and proper collection, recording of the evidence, chain of evidence, processing, interpretation methods, preservation of the evidence, proper presentation methods for different types of evidence, and the consequences of mishandling the evidence collected.