SLAMorris Final Thesis After Corrections.pdf - Cranfield University

4.2.1 Legal Constraints
The law can be defined as “the rules of a legal system”[Griffiths, 1979]; since
society adapts alongside the development of law it is suggested they may have
a symbiotic relationship. For a forensic analyst the legal framework ensures
evidence is handled in a fair and appropriate manner. The legal framework also
allows an analyst to understand what constitutes the evidence required for
conviction.
To be guilty of an offence it is generally necessary to prove that a physical act
was committed (actus reus), and that there was a guilty mind (mens rea) [Reed,
2005]. A guilty mind is generally defined as acting with intent; therefore an
analyst is not simply looking for the evidence of the crime, such as abusive
images of children, but is trying to establish whether they were intentionally put
on the system or are present without the users consent. This highlights the
requirement for an analyst to show the system behaviour which led to an
artefact being in its current state as well as the artefact which demonstrates an
act occurred.
When a user is completing an activity, they will use any technique they feel is
appropriate to fulfil their objectives. A forensic analyst must follow appropriate
methodologies when looking for evidence of a user’s actions; this ensures any
findings can be used as evidence. There are numerous resources on legislation
regarding acquiring computer based evidence that document what evidence
can be collected and appropriate methods for obtaining it [Thomas, 2004];
Forensic Computing methodologies are discussed in Chapter 2. Whilst such
legislation constrains the actions of those investigating a case, it also ensures
that the evidence being examined after acquisition has not been altered and is
likely to be admissible in Court; the methodologies assist in preventing breaks in
the chain of evidence that may prejudice the outcome of a case.
Page 48