Home > Acquiring of Evidence

The field of computer forensics deals extensively with acquiring the evidence. There are several steps that should be followed in order to acquire proper evidence. The first and the foremost among them are to find out the appropriate evidence that needs to be collected. The evidence may be in the form of hard copy or the soft copy. The surrounding environment also plays a part in the determination of the evidence. The soft copy of the evidence may also reside in the hard disk drives. The evidence may be damaged hence care must be taken to handle it with care.

There is a chain of evidence that describes the procedures to be undertaken in order to find appropriate evidence. The first thing is to locate the evidence. It is advisable to document the findings in order to maintain a decent record. Proper documentation of the procedures and the evidence collected is important part of investigative procedures. The data and the time from where the evidence has been collected should also be noted.

The location from the evidence has been obtained must also be noted down. The names and contact information about the people who all are involved in the discovery of the evidence must also be kept as a record. Information of the people who secured the evidence as well as those who all control and possess the evidence must also be collected.

The second most important thing is the examination of the evidence. The examination of the evidence may involve the computer media. The integrity of the computer data and the media that is used for the examination of the evidence is also important. The formal procedure would involve the documentation of the output from the evidence. Usually the evidence in high profile cases is sealed in the presence of a high ranking authority.

The purpose of this is to avoid any tampering of the evidence. The next step in the computer forensics is the presentation of the evidence such that it should lead to the justice and punishment to the criminal who has carried out the unethical process. The presentation should be made in a fashion so that it is helpful to the prosecutors to present it in a legal fashion.

Care must be taken in order to present the evidence. The presentation of the evidence should be made such that it should meet the following requirements. The most important thing is that the evidence should be relevant. The relevance should point to nature of the crime that has been committed.

In the sense the evidence should be related to the crime. Another important aspect regarding the evidence is that it should be permissible in legal terms and conditions. Also the point is that the evidence should be obtained in a legal manner and within the limits of a law. The chain is evidence is needed to maintain the reliability of the evidence.

There should be any tampering of the evidence. If the media like hard disk drive is used as evidence then the serial numbers and the data or information should remain intact with no changes what so ever. The directory structure and the file system should be noted down with utmost care.

More Information
General Information
Hardware
Privacy
Network Forensic Tool
File System
Data Security
Data Analysis
Data Encryption
Data Remanance
Defense Establishment
Networking
Internet Forensic
Data Security
Crime Investigation
Services
Incident Response Systems
Physical Damage
Cyber Crime
Privacy
Impact
Log File Recovery
Advance Partition Recovery
Intrusion Detection System
Data Encryption
Ethics

Related Information
Data Recovery Tools
SCSI RAID
DLT Tape Drives
Business Performance
Software Industry