How Computer Forensics Works - Standards of Evidence

If the investigators believe the computer system is only acting as a storage device, they usually aren't allowed to seize the hardware itself. This limits any evidence investigation to the field. On the other hand, if the investigators believe the hardware itself is evidence, they can seize the hardware and bring it to another location. For example, if the computer is stolen property, then the investigators could seize the hardware.

In order to use evidence from a computer system in court, the prosecution must authenticate the evidence. That is, the prosecution must be able to prove that the information presented as evidence came from the suspect's computer and that it remains unaltered.

Although it's generally acknowledged that tampering with computer data is both possible and relatively simple to do, the courts so far haven't discounted computer evidence completely. Rather, the courts require proof or evidence of tampering before dismissing computer evidence.

Another consideration the courts take into account with computer evidence is hearsay. Hearsay is a term referring to statements made outside of a court of law. In most cases, courts can't allow hearsay as evidence. The courts have determined that information on a computer does not constitute hearsay in most cases, and is therefore admissible.

If the computer records include human-generated statements like e-mail messages, the court must determine if the statements can be considered trustworthy before allowing them as evidence. Courts determine this on a case-by-case basis.

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to follow the electronic trail and find the digital evidence you need!

Computer Forensics Basics – How it works

The purpose of computer forensics techniques is to search, preserve and analyze information on computer systems to find potential evidence. Many of the techniques detectives use in crime scene investigations have digital counterparts, but there are also some unique aspects to computer investigations.

For example, just opening a computer file changes the file -- the computer records the time and date it was accessed on the file itself. If detectives seize a computer and then start opening files, there's no way to tell for sure that they didn't change anything. Lawyers can contest the validity of the evidence when the case goes to court.

Some people say that using digital information as evidence is a bad idea. If it's easy to change computer data, how can it be used as reliable evidence? Many countries allow computer evidence in trials, but that could change if digital evidence proves untrustworthy in future cases.

Computers are getting more powerful, so the field of computer forensics must constantly evolve. In the early days of computers, it was possible for a single detective to sort through files because storage capacity was so low. Today, with hard drives capable of holding gigabytes and even terabytes of data, that's a daunting task. Detectives must discover new ways to search for evidence without dedicating too many resources to the process.

What are the basics of computer forensics? What can investigators look for, and where do they look? Find out when the digital forensic experts from DLA discuss the steps in collecting evidence from a computer?

Computer Forensics vs. Cellular Forensics

Although these two may seem very similar, computer forensics and cellular forensics are different in many ways.

Any type of criminal case may use computer and cellular forensics as evidence, including drug dealing cases, theft of intellectual property or trade secrets, murder cases and even less serious cases like a disgruntled employee.

While a computer is indeed a storage unit for data, cell phones differ by make and model and what type of data they contain, how it is stored, deleted data or how GPS is monitored.

When you contact a digital forensics investigator, make sure you are prepared with all the information…

- Make and model of the computer or cell phone

- The owner or account holder

- Whether or not the device is password protected

- Whether or not you know the password

It is also essential to explain exactly what information you would like to collect or what you suspect has happening and how the data will be used.

So, do you need a computer or cellular forensics investigator?

Unfortunately, as more people are affected by cybercrime and technology plays a bigger role in criminal and civil matters, you may need one of the following investigators:

- Computer forensics investigator

A computer forensics investigator will recover data from a computer. If you need evidence of activity on your computer, a qualified computer forensics investigator can get you all the proof you need. These investigators even have the ability to find hidden or deleted data and emails.

- Cellular forensics investigator
Depending on the make and model of a cell phone, a cellular forensics investigator will recover data, passwords, chat history, SMSs, photographs, GPS and other information from a cell phone. They even have the ability to access deleted or hidden information from a device.

Would you like the help of experienced investigators? Contact DLA today and they will use the latest technologies to achieve the digital evidence that you need!