Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

evidence must meet requirements of Federal Rules of Evidence 702. The rule 702
states that the expert testimony is based upon sufficient facts or data. The testimony is
the product of reliable principles and methods and has applied the principles and
methods reliably to the facts of the case. This rule suggests that scientific evidence is
considered as competent and valid if the evidence is based on reliable scientific
principles and methods. Daubert standard suggests that five factors should be
considered when validating scientific evidence (see below bulleted list). In 1999,
Kumho Tire Co. v. Carmichael (1999) case extended the applicability of Daubert
approach to all non-scientific expert testimony. The court concluded that the five
factors in the Daubert standard are not a definitive checklist. For example, the
evidence that is not subject to peer review and publication should not be excluded
from the case. Also, a theory or technique that is generally accepted by the scientific
community does not mean the evidence is admissible in the court. Ryan & Shpantzer
(2002) clarified that testimony may still be admissible by the court even if one or more
of the Daubert factors are unfulfilled. Daubert Standard (Daubert v. Merrell Dow
Pharmaceuticals, Inc., 1993, p.1) recommends the following five guidelines should be
considered when evaluating the admissibility of the evidence:
The theories or techniques utilised by expert witness have been tested.
Subjected to peer-review and publication.
Known or potential error rate and the existence.
The existence and maintenance of standards and controls concerning its
operation.
Degree to which the theory and technique is generally accepted by a relevant
scientific community.
In addition to reliability, the authenticity of the evidence is another criterion for the
evidence to be admissible in court. Federal Rules of Evidence 901(a) (2007) defines
evidence as sufficient to support a finding that the matter in question is what its
proponent claims. In general, testimony clearly establishes that the exhibits presented
as evidence are identical to the original and the content has not been changed by any
means. Ridder (2009) describes that when trained law enforcement investigators
gather evidence, they should eliminate problems that compromise evidence
authenticity. For example, authentication of a duplicate hard drive mirror image can be
achieved by a proven time-stamping technique. A hash value can be computed for
21