Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

3. Duplicability and
Modifiability
4. Invisibility
5. Crosses
jurisdictional
borders
Digital evidence can be easily changed, altered, stolen or duplicated
without any trace. Information transferring across network can be lost or
incomplete due to network failure.
During e-commerce, personal information such as IP address, web
browser used, computer names will be transferred across the Internet. All
the information can be considered as digital information if it is relevant
and reliable.
Digital crimes can happen anywhere. Different jurisdictions create extra
barriers to prosecution of digital crime perpetrators.
The Table 2.3 describes five characteristics of the digital evidence in order to
understand the admissibility of digital evidence in court and also why digital evidence
has to go through different tests before it can be admissible in the court. The integrity
and accuracy of the digital evidence can be easily compromised because of the
characteristics. Admissibility of the digital evidence is discussed in the following
section.
2.2.2 Admissibility Of Digital Evidence In Courtroom
US courts have a detailed and strict set of rules and policies regarding the admissibility
of any type of evidence. There are three major guidelines that govern rules about
handling digital evidence in US: the Federal Rules of Evidence, the Daubert standards
and the case laws (Manes & Downing, 2009). Digital evidence is not unique and can
be easily duplicated or modified without leaving traces therefore the admissibility of
digital evidence is open to challenge.
From 1923 to 1993, admissibility of scientific evidence was tested by Frye
standard which came from a case Frye v. United States (1923). The Frye test held that
expert testimony must be based on scientific methods that are generally accepted by
scientific community. In 1993, Daubert standard (Daubert v. Merrell Dow
Pharmaceuticals, Inc., 1993) replaced the Frye test as the standard for admissibility of
expert evidence in federal courts. Under the Daubert standard, the United States
Supreme Court ruled that the trial judge must serve as gatekeeper to scrutinize whether
the evidence is not only relevant but also reliable (Adams, 2008). In other words,
20