Digital Evidence Examination
When dealing with digital evidence, general forensic and procedural principles should be applied. Actions taken to secure and collect digital evidence should not affect the integrity of that evidence. Persons conducting an examination of digital evidence should be trained for that purpose. Activity relating to the seizure, examination, storage, or transfer of digital evidence should be documented, preserved, and available for review. The examiner should be cognizant of the need to conduct an accurate and impartial examination of the digital evidence. Digital evidence is fragile and can be altered, damaged, or destroyed by improper handling or examination. Examination is best conducted on a copy of the original evidence. The original evidence should be acquired in a manner that protects and preserves the integrity of the evidence. The purpose of the examination process is to extract and analyze digital evidence. Extraction refers to the recovery of data from its media. Analysis refers to the interpretation of the recovered data and putting it in a logical and useful format.
How is digital evidence processed?
- Assessment.
- Acquisition.
- Examination
- Documenting and reporting