Questions: Evidence dynamics is anything that changes, moves, or obliterate evidence. Discuss what is digital evidence, in addition, what does the difficulties related to obtaining digital evidence exist?
Digital Evidence is information and data that is stored or used in a digital format that is related to a legal case. Some examples of Digital Evidence are emails, databases, digital photos, videos, and audio files and many more. The amount of digital evidence used to solve crimes is growing the more that individuals and businesses become integrated with technology. Almost all records of business activity are recorded digitally. Also, private individuals frequently store their personal information and conversations digitally and spend extended time on digital devices that record their activities. All of which have the potential to be used as digital evidence in the event of a legal investigation taking place.
However, while there are massive amounts of digital evidence, there are also issues in obtaining the evidence. The amount of evidence is so great it might prove difficult sifting through all of it to find the correct evidence pertaining to your case, especially when searching through anonymous forums over the internet. Tracing evidence to individuals has become increasingly difficult as users learn to hide their digital footprint. Almost all digital evidence can also be deleted and may become impossible to recover all or any of the source data. It seems there is a tug of war between creating tools to find and recover evidence, and tools that hide and delete evidence.
References
Boddington, R. (2015, March 17). The Challenges of Digital Forensics. Retrieved from PhysOrg: https://phys.org/news/2015-03-digital-forensics.html
Digital Evidence Law and Legal Definition. (n.d.). Retrieved from USLegal: https://definitions.uslegal.com/d/digital-evidence/
According to Easttom, digital evidence is information that has been processed and assembled so that it is relevant to an investigation and supports a specific finding or determination. All the data has to be relevant to the case in order for it to be considered evidence. Our textbook describes 4 different types of evidence, the first type of evidence discussed is real evidence. Real evidence is a physical object that someone can touch, hold, or directly observe like a laptop for example. The second type of evidence is documentary evidence which is data that is sorted in a written manner, on paper or in electronic files like emails, logs, and photographs. The third type of evidence discussed is testimonial evidence which is information that forensic specialist use to support or interpret real or documentary evidence. This type of evidence is typically the simplest because it’s usually a statement made by a witness and it doesn’t require any other piece of evidence to support it. The last type of evidence discussed is demonstrative evidence which is information that helps explain other evidence like a chart or graph.
When obtaining digital evidence you need to make sure of the laws that would effect the investigation. Every jurisdiction has different legal requirements and some have passed laws that require the investigator to either be a law enforcement officer or to be a licensed private investigator for them to extract the evidence. Another complication when dealing with digital evidence is the handling of it. When dealing with digital evidence you want to handle the original evidence as little as possible to avoid altering any of the information. There’s a chance of accidentally altering the data which would prevent another investigator from doing a fresh analysis. Altering information can be something as small as changing the time stamp on a file.
Reference:
Easttom, C. (2019). System forensics, investigation, and response (Third). Burlington, MA: Jones & Bartlett Learning.