X hits on this document

PDF document

Hassel Stacy Jr. Dr. Philip Lunsford ICTN4040 601 04/16/06 - page 3 / 8





3 / 8

Stacy 3

Most law enforcement departments use the following criteria when collecting evidence from a

cybercrime. There should be access to tools and equipment necessary to document, disconnect,

remove, package, and transport digital evidence. Preparations should be made to acquire the

equipment needed to collect forensic evidence. Actions taken to secure and collect computer forensic

evidence should not change the evidence. Persons conducting the examination of electronic evidence

should be trained for the purpose. Activity relating to the seizure, examination, storage, or transfer of

electronic evidence should be fully documented, preserved, and available for review.

What is digital evidence? Digital evidence is information and data of investigative value that

is stored on or transmitted by an electronic device. Such evidence is acquired when data or physical

items are collected and stored for examination purposes. Computer forensic evidence is often latent in

the same sense as fingerprints or DNA evidence. It can cross borders with ease and speed, is fragile an

and can be easily altered, damaged, or destroyed, it is sometimes time sensitive. User created files, on

computers involved in computer forensic investigations, may contain important evidence of criminal

activity such as address books and database files that prove criminal association, still or moving

pictures that may be evidence of pedophile activity, and communications between criminals such as

email or letters. Other files which may contain useful forensic evidence are address books, audio/video

files, calendars, database files, documents or text files, email files, image/graphic files, Internet

bookmarks/favorites, and spreadsheets. Some other useful information might be Internet protocol

addresses, keyword lists, ,nicknames, passwords, points of contact, and supporting documents.

Computer forensic evidence, like all other evidence must be handled carefully and in a manner

that preserves its evidentiary value. Certain types of computer evidence, requires special collection,

packaging, and transportation procedure. Thoughtfulness should be given to protect computer data that

Document info
Document views25
Page views25
Page last viewedMon Jan 16 12:58:51 UTC 2017