Digital Forensics and Electronic Evidence

With the extremely fast pace of technology development, electronic evidence has become a potential part of nearly all court cases. For this reason, many more people are now faced with the need to understand electronic evidence. This could be a legal representative, the person involved in a case or simply someone who would like to know more about the things we often see on television.

During many years of forensics consulting, we have seen how difficult it is for legal professionals and other people faced with legal action to gain an understanding of the principals of electronic evidence, especially when there is limited time available and they do not have a strong technical background. A proper understanding can go a long way to strengthen a case as it often exposes weaknesses in the procedures and evidence used by the opposition.

Few resources exist that gives an overview of the field and what is available, is often of a highly technical nature. Normally many resources need to be consulted to get an understanding of even some of the basic principles. By summarising many years of practical experience, the course aims at providing a solid understanding of the important principles in a short time without the need for a technical background.

The purpose is not to create experts, but to give enough background knowledge to individuals to know the possible areas of importance that need further research for the cases they are involved in. Like any other court case, cases involving electronic evidence will have unique complexities, but knowing where to look will often simplify matters considerably.

Only a very basic knowledge of computers and no legal background is assumed. Even so, the course contains material that will be useful to many people with a strong background in one or both of these fields.

At the end of the course students will:

• Know what type of permission is needed to obtain electronic evidence.
• Know the procedures that must be followed to ensure that electronic evidence remains unchanged and admissible in court.
• Know how electronic evidence is collected from computer equipment.
• Know how electronic evidence is collected from mobile equipment.
• Know how electronic evidence is analysed.
• Know the types of evidence that is likely to be found on computing devices.
• Know what needs to be included in a proper forensic report that can be used by the court.
• Be able to identify weaknesses in evidence and the processes used to collect it.

The course should also be useful for anyone considering a career in digital forensics, to understand the difference between digital forensics and computer security. This is important, as the perception is often that digital forensics is just a part of computer security that involves exciting opportunities for hacking, something that is certainly not the case.

A list of freely available software that can be used by students to do basic forensic investigations is also given for those who would like to expand their skills.