Crosby-Signed Thesis - Alliance Digital Repository

IMPACT OF IPV6 TRANSITION MECHANISMS ON THE NETWORK FORENSIC
13
Sommer (1999) and Daubert v. Merrell Dow Pharmaceuticals Inc ("Daubert v. Merrell
Dow Pharmaceuticals Inc.," 1993) both provided suggestions for effectively collecting and
handling network based evidence. The prosecutor’s objective should be to present the data with
the aid of expert testimony and derived presentations and then corroborate the facts with other
evidence. This research presented some of the considerations for IPv6 evidence that could
present a problem for investigators. The lack of research into IPv6 investigation techniques
decreases the admissibility of the evidence under the Daubert standard which requires
evidentiary techniques to be based on established academic disciplines.
Digital evidence handling.
The procedural standards and admissibility issues surrounding digital evidence collection,
storage, analysis, and presentation are well represented in the literature. Although, the standards
for processing digital evidence follows a fairly standard structure, jurisdictional differences in
legal precedent and statutes create challenges in formulating a solid procedural framework for
digital evidence processing.
Digital evidence is relevant data used to prove that a crime or event has taken place (Lan,
et al., 2005). The research by Lan, Lin, Lin, and Wu (2005) identified the characteristics of
digital evidence as being technical, changeable, invisible, and flexible. It further identified three
classifications of digital evidence. Document evidence is content that can be printed or viewed
like document, text, and log files. Material evidence is content that can be read when executed by
another application like executable (EXE) or Moving Picture Experts Group Layer-3 (MP3)
files. Other evidence is content that cannot be printed or viewed like compressed (ZIP) and
dynamic link library (DLL) files.