NCJ Number
211186
Journal
Evidence Technology Magazine Volume: 3 Issue: 4 Dated: July-August 2005 Pages: 16-18
Date Published
July 2005
Length
3 pages
Annotation
This article reviews the importance of preserving and protecting computer evidence.
Abstract
The Internet and the widespread use of personal computers have changed the way forensic investigators approach criminal investigations. In many cases, valuable evidence is contained on computers and investigators must take care to properly preserve and protect that evidence. The investigative issues unique to computer investigations are reviewed and include the problem of spoliation, which is the destruction of electronic evidence. Spoliation can occur either inadvertently or deliberately and the author presents case examples of how to avoid losing evidence to spoliation. The importance of dates indicating when files were created is underscored and the steps of a proper forensic investigation of a computer are reviewed, including a description of the use of hash codes to ensure the integrity of the forensic process. References