chapter 1 computer forensics and investigations as a profession

“Evidence”
An item does not become officially a piece of
evidence until a court admits it as such
Opposing counsel can (and will) challenge this
admission
Incidentally, attorneys do argue with me about which
comes first – the evidence or its admission
Typically where we use the word “evidence,”
we’re using it as a shortcut for “item of potential
evidentiary value”
Much of forensics practice concerns how to
collect, preserve and analyze these items
without compromising their potential to be
admitted as evidence in a court of law
Chapter 01 9
Chapter 1
So what is “digital evidence”?
ISO 27037 – “information or data, stored or
transmitted in binary form that may be relied
on as evidence”
Eoghan Casey – “any data stored or
transmitted using a computer that support or
refute a theory of the offense such as intent
or alibi” (Dig. Evid. & Comp. Crime, p. 7)
Brian Carrier – “digital data that support or
refute a hypothesis about digital events or
the state of digital data” (CERIAS TR 2006-6)
Chapter 1 18
17