Skip to content

Digital evidence

Digital evidence is the collective term used to describe information or materials stored or transmitted in digital form that is to be tendered as an exhibit in a context of law, such as court. The past few decades have seen an explosion in the use of technology in all walks of life and industry. From email to automated control systems for water supplies, information systems and technology underpin our modern society. Perhaps unsurprisingly, criminals have moved with the times, finding means by which to leverage technology in the commission or support of offences.

Note that this article is based on RFC 3227.

Handling

Some principles of handling digital evidence:

Avoid:

  • Unauthorized disclosure; Digital evidence is often sensitive also in certain cases it requires qualified persons to access digital evidence
  • Misuse
  • Alteration; Make sure no change of data while handling of the data, note that with very volatile data this often means after acquisition and due to failure of storage media this it is not always possible to guarantee.
  • Destruction

Collection

The methods used to collect evidence should be transparent and reproducible. You should be prepared to reproduce precisely the methods you used, and have those methods tested by independent experts.

Order of Volatility

When collecting evidence you should proceed from the volatile to the less volatile. Here is an example order of volatility for a typical system.

  • CPU (or equivalent processing units) registers, cache
  • routing table, ARP cache, process table, kernel statistics, memory
  • temporary file systems
  • disk
  • remote logging and monitoring data that is relevant to the system in question
  • physical configuration, network topology
  • archival media

Reconstruction

Types of reconstruction:

  • Relational - how one finding is related to another: Correlation
  • Functional - how one finding can be used/applied
  • Temporal - events related to the timeline

Evidentiary standards of proof

To be legally defensible in a court of law, computer evidence must satisfy traits of evidence by being admissible, authentic to the incident, contextually complete, reliable in its forensic handling, and easily believable to a judge and/or jury.

See Also