Digital Forensics: Best Practices, Research Paper Example

The collection and reconstruction of digital evidence of a crime must continually change with digital technology. This paper will start with a definition of digital forensics that won’t change[1]: The process of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally accepted (Leigland, 2004). We can view those four stages as the process of uncovering and reporting to police, lawyers, judges, and juries the who, what, where, when, and how (and leaving the why to those authorities). But there are four additional unchanging precepts that best practices dictate should be followed when conducting an investigation.

First and arguably the most important: make exact and authenticated copies of the original data, and then base your active investigation on those copies. In other words, keep the handling of the original data and equipment to a minimum, at least at the preliminary stage. Second, be prepared to document any changes to the evidence, either original or copies, even when such changes are routine and unexceptional (such as when RAM and temporary files are changed when the computer or device is turned on and off). Third, follow all rules of evidence appropriate for the kind of case you have, i.e., criminal or civil. The fact that the evidence is digital will grant you no special leeway in the courtroom. (Indeed you may have less.) Fourth, do not claim expertise that you do not have. If confronted with an operating system or programming language that you do not have professional experience with, be prepared to say so at the outset.

Police, lawyers, judges, and juries will include both digital experts and neophytes. Demonstrate to them all that accepting the inevitability of digital forensics and preparing for it before it is needed will be instrumental to a successful outcome when that need finally arrives.

References

Leigland, R. (2004). A Formalization of Digital Forensics. International Journal of Digital Evidence, 3(2), Retrieved from http://www.utica.edu/academic/ institutes/ecii/ publications/articles/A0B8472C-D1D2-8F98-8F7597844CF74DF8.pdf

[1] Except for its name, digital forensics, which was formerly known as computer forensics but is now broadened to  include mobile devices.