SLAMorris Final Thesis After Corrections.pdf - Cranfield University

To minimise the possibility of fraudulent evidence being admitted, authentication
procedures are required to analyse the chain of evidence [Kenneally, 2004].
The analysis must account for any movement of the evidence, or interpretation
of the data. This may be a physical change such as from the custody of an
individual to another; or it may be a change in the interpretation of the data, for
example locating and extracting deleted files. Justification for any action taken
which alters the state of the original evidence needs to be provided to show an
analyst understands how the evidence being presented in their report was
obtained [National Center for Forensic Science, 2003]. The documentation of
these actions shows clearly what has happened to the data and assists with
establishing that any evidence produced is an accurate representation of the
original data.
To ensure the ACPO guidelines are complied with, it is necessary to understand
the consequences of any action performed ensuring the relationship with the
original data is maintained. It is also necessary to justify the behaviour of the
software being used during examinations, to ensure that any changes made to
the evidence do not affect its integrity [ACPO, 2010]. In the UK, the ACPO
guidelines are a significant part of a good practice approach to investigating
computer crime. However as computer crime is a global problem and may
involve several legal jurisdictions in a single case it may also be necessary to
consider what constraints affect procedures elsewhere in the world. The USA
has produced a set of guidelines based upon their legal requirements [NIST,
2004], which when compared to the UK’s guidelines highlight the common
theme of ensuring the integrity of the evidence by producing a clear chain of
evidence.
4.2.5 Human Behavioural Constraints
A forensic computing analyst examines digital media, from which they produce
evidence related to the issue under investigation. Whilst it is not their job to
Page 55