Software Quality in E-Discovery

Electronic evidence is very fragile because it can be destroyed or altered very easily, therefore it is imperative that investigators follow very careful all the procedural steps when collecting electronic evidence (Diversified Forensics). Before any electronic evidence is gathered investigators should determine whether there is probable cause that a crime has been committed, or if the crime was committed somewhere else the investigator should determine whether the electronic evidence will aid the investigation process to prove or disapprove the crime, if a warrant is needed it must be obtained prior to collecting the evidence (Diversified Forensics). Hard drives, computers, and other electronic devices must be turned off, unplug all cables,

For this reason, it is imperative that the information gathered is reliable and accurate to ensure the evidence collected can be utilized by the digital forensic investigator for the current case (Ingalls & Rodriguez, 2011). Additionally, cyber incidents require digital forensic investigators to interview various individuals regarding the information needed for the case. According to the National Institute of Justice (2004), interviewing the system administrator, users, and employees of an organization regarding a cyber incident would provide investigators with valuable information; for example, user accounts, email accounts, network configuration, logs, and passwords. Furthermore, for digital forensic investigators to conduct an effective interview, they must have the proper tools and training to employ the interview process. For instance, formal procedures or instructions should be developed and implemented to ensure that the investigator follows a standard during all investigations. Additionally, training should be provided to ensure that digital forensic investigators comprehend by what means to prepare, conduct, and evaluate an interview. Furthermore, resources should be made available for digital forensic investigators to accomplish their tasks; for example, recording devices and references. Also, definitions should be provided to the digital forensic investigators for

Data is crucial to the success of any company and they are now increasing their efforts in soliciting and retrieving customer data to learn more about their client's preferences, likes, and dislikes. This, among other factors has attributed to a growing field of data science where data scientists learn to collect crucial data. While there are many types of data, this paper will primarily focus on digital data and how digital scientists can retrieve these data to support provide information for the crown or for the defense. This area has received more attention because criminals such as terrorists have realized the effectiveness of using digital devices to aid in their criminal endeavors (Reith, Carr & Gunsch, 2002, p.2). To combat this, law enforcement agencies are now relying on digital scientists to preserve, collect, analysis and interpret "digital evidence derived from digital sources" (Vincze, 2016, p.184) to help prevent cybercrime and prosecute (or exonerate) suspects. The purpose of this paper is then to illustrate why digital forensic is crucial to addressing the new dangers presented in our society by analyzing the strengths and demonstrating why the weaknesses of the field

a. Particular care was taken in the discovery, recovery, preservation and control of electronic data, documents and E-evidence.

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

Computers are common tools used by the culprits behind white-collar crimes. In order to find “culprits,” the forensic accountant will need to be able to dig deep into the company’s computer system. However, without the proper equipment, that process can prove to be very difficult. To facilitate the preservation, collection, analysis, and documentation of evidence, forensic accountants can use specialized software and computer hardware.

The third and a crucial weakness is the lack of education in digital science. Reports and research consistently indicate that there is a lack of "education, training and certification" (Roger & Seigfried, 2004, p.14) and because there is no uniform certification, there is no gold standard that many other forensic sciences possess (Roger & Seigfried, 2004, p.15). To clarify, the reports do indicate that there exist certification boards for this field, but the problem with these certification boards is that there are specific to a "particular operating system" (Roger & Seigfried, 2004, p.15), meaning a certification for a board may mean something completely different to another. This is worrisome as with no universally accepted standards, it makes it hard for judges and juries to effectively judge the competency of any expert (Vincze, 2016, p.186). Furthermore, there is a proliferation of digital forensic classes as a consequence of the media exposure

First, large amounts of data are non-searchable because their contents cannot be readily searched with keywords or other-automated methods. To render the material searchable or to manually search it requires enormous resources. Next, backup tapes and other duplicative data can incur significant costs given archived information cannot be immediately searched as they require transcription to a computer first. In fact, the problems with searching this data are so immense courts have treated backup tapes as inaccessible. Another common form of electronic data, databases, also poses significant issues given the cost and feasibility of actually searching through the data. The metadata associated with stored data also poses a number of problems. These problems include: whether the metadata is actually part of the discovery request, insuring the metadata is not modified during production, and actually reviewing the data given the difficulty of accessing and aggregating it. Finally, given many companies have automated deletion policies and producers bear “the burden of proving all readily accessible sources of the requested ESI have been adequately searched”, the restoration of deleted data can often aggravate discovery costs. Thus in many cases, the very nature of electronic data defies efforts to cabin its production

(LawBrain 2010) Basically this set forth guidelines for addressing evidence discovery in a new medium of electronically stored information (SRI). The problem was, before the 14 Sedona Principles, there were no real guidelines for how to approach ESI and present it in court. There were many interpretations with no baseline across States and, not to forget, many lawyers and magistrates while being very fluent in law were not familiar in the emerging presence of ESI and how to handle and/or interpret it. Thanks to the Sedona Conference Working Group and the 14 Sedona principles a baseline for dealing with the ever-growing amount of digital data that is used in court litigation was

Acquisition. Due to digital evidence’s fragile state, investigators should be aware that it is easily altered, damaged, or deleted by improper handling of the evidence. Examination best practices are conducted on a copy of the original evidence. The original evidence should be secured in a way that would protect a preserve the evidence in its original unaltered state.

Officers now cannot just send and receive emails; they must have enough knowledge about how to read signs of fraud or other cybercrimes. Officers must understand what types of viruses are out there and what they do to computers to obtain sensitive information on an individual level and especially on a large scale level, for example, cases involving credit card companies or major corporations’ financial records. Officers must know the proper procedures on how to collect e-evidence as well as preserve computer units if needed to be investigated during a case. Last but not least, officers must understand the intricacies of the laws of search and seizure that pertain to computer and e-evidence, otherwise one wrong move or improper handling of evidence could dismiss a huge lead or case. The good news is that with new technology also comes with it advanced detection methods and individuals who possess the skills and education to develop ways and programs to deter and prevent identity theft from happening at all. An investigator’s role is always to remain ahead of the game no matter what type of case they are

The revised regulation 26 (f) wanted social groups involved to converge early in the conduction of lawsuit process and brainstorm about issues relating to Electronically Stored Information discovery, and the strategies put in place. A talented person to take care of it is required, also the judges should be fully equipped with the relevant materials to defend their culprit. Grouping information as protected and listing it for peruse and recovery is information control step. Being aware of where data is kept and processed will not only help in keeping reduced cost but will also give an advantage of providing some surety when tackling the initial questions asked. It is of paramount importance that what is asked in early stages be given sure answers (Adler, 2007).

The role of a Computer Forensic Specialist is very important, in the field of Criminal Justice. Their role help aide law enforcements in investigating and retrieving evidence, related to criminal matters at the time. Their duties involves analyzing the subject’s computer using different kinds of tools that are provided to them. Tools like bit stream/bit-by-bit copy, hashing, forensic analysis, indexing process, recovering deleted data that were deleted by the subject, and encrypted files that are design for only certain people to gain access to. These investigative software or tools are very important and will aide in the process of a criminal investigation.

In 1995 and 1996 the judicial systems around the world realized that there was a problem with computer-based discovery and enacted civil procedures and guidance to assist legal entities. Summarizing Michael Curran, Esq. (2011) even with these civil procedures, guidance and laws in place, there are still several challenges in the legal systems when it comes to discovery of Electronically Stored Information when dealing with international e-discovery (Curran, 2011). This information may be protected under different data protection laws that can inhibit the e-discovery process during litigation, civil, and

In 2001, the first Digital Forensic Research Workshop (DFRWS) (http://www.dfrws.org/2001/dfrws-rm-final.pdf ) was held to produce and define a scientific methodology to drive digital forensic to produce a reliable Framework (dubbed Investigative Process for Digital Forensic Science) to drive the