Computer Forensics

Copyright Priscilla Oppenheimer

Week 3: Collecting and Preserving Digital Evidence

Admissibility of evidence

Must be legally obtained, (obeying the 4th Amendment and other federal and state laws)

Must be competent, relevant, and material

Competent = reliable (not tainted) and credible (believable)

Relevant = tends to prove a fact of the case

Material = substantiates (supports) a point of view that is in question in the case

The Frye standard (also known as the Frye test)

Types of evidence

Physical

Direct

Circumstantial

Demonstrative

Documentary

Documenting evidence with tags and logs

Maintaining the chain of custody

Processes for collecting computer evidence

For more info, see pages 5-36 in the US. Department of Justice's Electronic Crime Scene Investigation: A Guide for First Responders.

Also, check out the Computer Forensics: Seizing a Computer white paper by your instructor.

 

Case Study: Brandon Mayfield