Digital Evidence

Question 1

Witness Evidence:

Answer 1

Eyewitnesses or expert witnesses drawing on specialist skills. Transcripts of interviews under caution can be used. Recording used under Police and Criminal Evidence Act 1984 (PACE)

Question 2

Documentary Evidence:

Answer 2

Documents, not limited to written documents. Commonly subject to some form of authentication

Question 3

Real Evidence:

Answer 3

Physical evidence in form of material objects. Proves a fact based on demonstrable and verifiable physical characteristics

Question 4

Daubert Test Guidelines:

Answer 4

1) Judge must ensure scientific expert testimony proceeds from scientific knowledge
2) Judge must ensure the expert testimony is relevant to task at hand and rests on reliable foundation
3) Requires the use of scientific methodology

Question 5

Daubert Case Key Parameters for Scientific Methodology:

Answer 5

1) Empirical Testing: Whether theory or technique is falsifiable, irrefutable and/or testable
2) Whether its been subjected to peer review and publication
3) Known or potential error rate
4) Existence and maintenance of standards and controls concerning operation
5) Degree to which theory and technique is accepted by relevant scientific community

Question 6

Relevant Evidence:

Answer 6

Logically goes to proving or disproving some fact at issue in the prosecution

Question 7

Admissibility:

Answer 7

• Relates to facts at issue or
• to circumstances those facts probable or improbable and continuity of evidence
• Whilst no general test has been specified, reproducibility is considered critical for reliability

Question 8

Three categories of evidence obtained from computers:

Answer 8

1) Evidence processed by a computer when functioning as a calculated (real evidence)
2) Evidence that a computer is programmed to record (real evidence)
3) Evidence processed by a computer but entered by a person

Question 9

Major issues for computer crime is the complexity of underlying technology:

Answer 9

• Rarely the case any longer that evidence is located exclusively on a single physical device that can be analysed comprehensively
• Data may be distributed and even criminal acts may be distributed as in the case of botnets with obfuscated command and control channels
• Witnesses to computer crime scenes are usually other computers
• Digital forensics is fragile, any accidental or deliberate change, obliteration, relocation of evidence can render it void

Question 10

Good Practice Guide for Digital Evidence - Principle 1 (Integrity):

Answer 10

No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court

Question 11

Good Practice Guide for Digital Evidence - Principle 2 (Qualified):

Answer 11

In circumstances where a person finds i necessary to access original data held on a computer or on storage media, that person must be competent to do so and be ale to give evidence explaining the relevance and the implications of their actions

Question 12

Good Practice Guide for Digital Evidence - Principle 3 (Contemporaneous Notes):

Answer 12

An audit trail or other record of all processes applied to computed-based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result

Question 13

Good Practice Guide for Digital Evidence - Principle 4 (Roles):

Answer 13

The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the aw and these principles are adhered to

Question 14

UK Forensic Science Regulator (FSR) Codes of Practice:

Answer 14

All forensic laboratories in the UK are required to comply with ISO 17025:2005. General requirements for the competence of testing and calibration laboratories and ISO 17020:2012. Requirements for the operation of various types of bodies performing inspection