According to the National Institute of Justice, digital evidence is information and data of value to an investigation that is stored on, received, or transmitted by an electronic device. This evidence is acquired when data or electronic devices are seized and secured for examination.
Digital evidence:
Is latent, like fingerprints or DNA evidence.
Crosses jurisdictional borders quickly and easily
Is easily altered, damaged, or destroyed.
Can be time sensitive.
It is important to remember that digital evidence may also contain physical evidence such as DNA, fingerprints, or serology. As such, physical evidence should be preserved for appropriate examination.
Handling Digital Evidence at the Scene
Precautions should be taken in the collection, preservation, and transportation of digital evidence. First responders may follow the steps listed below to guide their handling of digital evidence at an electronic crime scene:
Recognize, identify, seize, and secure all digital evidence at the scene.
Document the entire scene and the specific location of the evidence found.
Collect, label, and preserve the digital evidence.
Package and transport digital evidence in a secure manner.
Before collecting evidence at a crime scene, first responders should ensure that.
Legal authority exists to seize evidence.
The scene has been secured and documented.
Appropriate personal protective equipment is used.
First responders without the proper training and skills should not attempt to explore the contents of or to recover information from a computer or other electronic device other than to record what is visible on the display screen. Do not press any keys or click the mouse.
(Information is provided courtesy of the U.S. Department of Justice).
Recommended Digital Evidence Reading
Digital Evidence and Computer Crime by Eoghan Casey
Book Description
Digital evidence - evidence that is stored on or transmitted by computers - can play a major role in a wide range of crimes, including homicide, rape, abduction, child abuse, solicitation of minors, child pornography, stalking, harassment, fraud, theft, drug trafficking, computerintrusions, espionage, and terrorism.
Though an increasing number of criminals are using computers and computer networks, few investigators are well-versed in the evidentiary, technical, and legal issues related to digital evidence. As a result, digital evidence is often overlooked, collected incorrectly, and analyzed ineffectively. The aim of this hands-on resource is to educate students and professionals in the law enforcement, forensic science, computer security, and legal communities about digital evidence and computer crime.
This work explains how computers and networks function, how they can be involved in crimes, and how they can be used as a source of evidence. As well as gaining a practical understanding of how computers and networks function and how they can be used as evidence of a crime, readers will learn about relevant legal issues and will be introduced to deductive criminal profiling, a systematic approach to focusing an investigation and understanding criminal motivations.Readers will receive access to the author's accompanying Web site which contains simulated cases that integrate many of the topics covered in the text. Frequently updated, these cases teaching individuals about:
Components of computer networks
Use of computer networks in an investigation
Abuse of computer networks
Privacy and security issues on computer networks
The law as it applies to computer networks
In addition, Digital Evidence and Computer Crime provides a thorough explanation of how computers and networks function, how they can be involved in crimes, and how they can be used as a source of evidence. It offers readers information about relevant legal issues, features coverage of the abuse of computer networks and privacy and security issues on computer networks and comes with free unlimited access to author's Web site which includes numerous and frequently updated case examples.