The aim of this report is to theoretical cover data preservation, examination of digital evidence, tools and techniques for data capture, preservation and examination with a list of recommendations.
In our modern society, computers and other digital devices are becoming ubiquitous. In the late 1970’s the number of crimes that involved digital devices and computers has been increasing rapidly. As a result of that, computer experts specified the need for permanently improving digital forensic tools and practices.
Digital Forensic is described as “ a forensic science encompassing the recovery and investigation of materials found in digital devices “ (“Introduction to Digital ...view middle of the document...
• Examining the evidence.
2. Securing the Crime Scene
Protecting the crime scene is the most significant aspect of evidence collection and preservation. A crime scene is defined as the “location where a crime took place (or another location where evidence of the crime may be found), and comprises the area from which most of the physical evidence is retrieved by law enforcement personnel, crime scene investigators (CSIs) or in rare circumstances, forensic scientists. Crime scenes may or may not be where the crime was committed. There are different levels and types of crime scenes.” (“Crime Scene,” 2014).
The crime scene preservation starts with the arrival of the first police officer at the crime scene and finishes when the crime scene is released from the police custody. Intensive training is included for the staff of police departments and sheriff’s offices on how to completely preserve crime scenes because any police officer can be the first responding officer to a crime scene.
At a crime scene, the officer safety and the safety of everyone is the major consideration of the first responder. Any activities that are done by the experts at the crime scene should be in compliance with the departmental policy, local laws, State, and Federal.
The second step is to visually distinguish all conceivable evidence and preserve that the safety of both evidence, digital and traditional. Evidence on digital devices such as computers, cameras and other digital devices can be readily changed, deleted or damaged. The duty of the first responder is to quickly document, photograph and obtain digital evidence at the scene.
The first responder should follow these basic steps when securing and evaluating the crime scene:
• Follow the departmental policy for securing crime scene.
• All personal and portable digital devices should be promptly secured.
• Secure the digital evidence from unauthorized people.
• Ensure that the conditions of all digital devices are not altered.
• Leave digital devices such as computers turned off.
The above steps secure digital evidences from being altered. However, the first responder should also follow the suitable steps to secure the physical evidence from being compromised throughout the documentation.
3. Preserving the Evidence
“Preservation of evidence means deliberate and specific action taken or caused to be taken with the intention of preventing contamination to, damage to, the loss of, or destruction of, any evidence, including the recording, storage and maintenance of continuity of such evidence” (Queensland Government, 2011)
All digital evidence must be inventoried and secured to preserve its integrity from the crime scene to the forensic laboratory to the courtroom. At a trial, it is significant to prove that the digital evidence is the same digital evidence obtained at the crime scene, and that the access to the evidence was documented and controlled.
A proper authority such as a court order must be with the...