Question

Maintaining evidence integrity is one of the most important steps in the digital forensic investigation. Provide some examples of how the integrity of evidence can be discredited during a digital forensic investigation. What are some ways that law enforcement can ensure that evidence integrity is maintained during a digital forensic investigation?

Answer 1

Digital forensic is defined as the application of forensic science techniques to computer-based material, Digital Forensics involves scientifically examining and analyzing data from computer storage media so that data can be used as evidence in court,
Is the process of identifying, preserving, analyzing and presenting digital evidence.

Never analyze the seized evidence directly. The original evidence must be secured and protected with a chain of custody. It should never be subjected to a forensic examination because of the fragile nature of digital evidence. A forensic copy, however, can be examined, and, if something goes wrong, can be discarded, and the copy process can be repeated. A good forensics process will prove that the forensic copy is identical to the original at the start and at the end of the examination. From a practical standpoint, investigators usually make multiple forensic copies and perform their analysis in parallel on the multiple copies.

For example, theft can now be done electronically, using bank cards and hacking into bank accounts. There is also the example of indecent images of minors being distributed freely and quicker via the internet than it would have been in the past.

*There is also the example of indecent images of minors being distributed freely and quicker via the internet than it would have been in the past.

Computer forensics investigators must have a solid understanding of computer science and related criminal activities. Confidence, assertiveness, persistence, determination, patience, and good problem-solving skills are essential characteristics. Computer forensics investigators must have excellent communication and ability to work as part of a team. They must not be afraid of confrontation and be able to think quickly on their feet. They should have a curious nature - one that leads you to want to dig and ask questions and keep at it until you figure out the answers. They should be organized, as they'll be dealing with a lot of information and they must be able to recognize patterns and see correlations. Excellent observation skills, and is capable of seeing both the minute details and the "big picture." Finally, they need to be able to meticulously document their findings and often, to be able to present them to others, who don't have the specialized knowledge, so they need both good writing skills and good speaking skills.

*The investigator should ensure that the evidence is preserved and secured well. If she fails to do so, the evidence will be inadmissible when it is submitted to a court of law. While collecting digital evidence at the crime scene, the investigator should take the following steps to secure it:

• Follow departmental guidelines if possible or use 'A Guide for First Responders'
• Document and verify the hardware configuration of the system to be examined
• Disassemble the computer to be examined
• Identify and document the internal storage devices