Module 1 DF
What is Digital Evidence?
Digital Evidence refers to any information or data that is stored, transmitted, or retrieved from a
computer, digital device, or electronic storage medium that can be used in a court of law.
It includes any traces left in digital form that can prove or disprove facts in an investigation.
Examples:
Emails, chat logs, text messages
Browser history and cache files
System logs and metadata
Images, videos, and audio recordings
Files recovered from hard drives, USBs, or cloud storage
Network traffic and IP logs
Digital evidence plays a crucial role in cybercrime investigations, forensic analysis, and legal
proceedings.
Challenges in Handling Duplication and Preservation of Digital Evidence
When handling digital evidence, investigators face two major technical and legal challenges —
duplication (creating copies) and preservation (maintaining integrity).
Let’s discuss both in detail:
1. Duplication Challenges
Duplication means creating an exact bit-by-bit copy of the original digital evidence (e.g., hard
disk, memory, USB) without altering its content.
Challenges:
1. Maintaining Integrity:
o Even a minor change in a file (like a single byte) can alter hash values
(MD5/SHA1), making the evidence inadmissible in court.
2. Large Volume of Data:
o Modern systems store terabytes of data. Creating forensic images of entire drives
consumes significant time, space, and resources.
3. Use of Proprietary or Encrypted Formats:
o Some storage devices use proprietary formats or encryption, making
duplication difficult or incomplete.
4. Volatile Data Issues:
Data in RAM or cache exists only temporarily and disappears when the device is
o
powered off, making duplication tricky.
5. Chain of Custody:
o Improper documentation during copying can raise doubts about authenticity and
tampering.
2. Preservation Challenges
Preservation involves securing and maintaining digital evidence so it remains unaltered from
the time of acquisition until it is presented in court.
Challenges:
1. Data Volatility:
o Data in volatile memory, temporary files, or active logs can be lost easily if not
preserved immediately.
2. Environmental Factors:
o Physical damage, magnetic interference, or power surges can corrupt stored
digital data.
3. Encryption and Password Protection:
o Strong encryption can prevent access to evidence, and forced decryption may alter
timestamps or metadata.
4. Legal and Jurisdictional Issues:
o Data stored on cloud servers or in foreign jurisdictions may be difficult to
preserve legally.
5. Technological Obsolescence:
o Old storage devices or file systems may no longer be supported by modern
hardware/software, complicating evidence retrieval.
6. Human Error:
o Mishandling by investigators (accidental editing, improper shutdown, etc.) can
lead to data modification or loss.
Best Practices for Duplication and Preservation
1. Use Write Blockers:
o Prevents any modification to original data during duplication.
2. Create Forensic Images:
o Use tools like FTK Imager, EnCase, or dd to make bit-by-bit copies.
3. Generate and Verify Hash Values:
o Compute MD5/SHA256 before and after duplication to ensure authenticity.
4. Maintain Chain of Custody:
o Document every step — who handled the evidence, when, and how.
5. Store Evidence Securely:
o Use tamper-proof containers and secure digital vaults for preservation.
6. Follow Legal Procedures:
o Obtain proper warrants and adhere to jurisdictional laws for admissibility.
Daubert’s Rule (Daubert Standard)
Definition:
The Daubert Rule (from Daubert v. Merrell Dow Pharmaceuticals, 1993) sets the criteria that
U.S. federal courts use to determine whether expert scientific testimony — including digital
forensic evidence — is reliable and admissible in court.
Key Requirements under Daubert’s Rule
1. Peer Review and Publication
o The forensic method or tool should be peer-reviewed and published in reputable
journals.
o Example: Tools like EnCase and FTK have undergone academic validation and
independent studies.
2. Known Error Rates
o The reliability of forensic tools must be demonstrated by known error rates and
their limitations disclosed.
o Example: A tool with a 2% false-positive rate must be documented and reported.
3. Standards Compliance
o The method must follow recognized scientific or forensic standards, such as:
ISO/IEC 27037 – Guidelines for identification, collection, and
preservation of digital evidence
NIST (National Institute of Standards and Technology) – Forensic
testing procedures and benchmarks
4. General Acceptance in the Scientific Community
o The technique should be widely accepted and used by experts in digital forensics.
o Example: Tools like Autopsy and Sleuth Kit are recognized and accepted
globally.
Case Reference:
Daubert v. Merrell Dow Pharmaceuticals (1993):
The U.S. Supreme Court ruled that judges must act as “gatekeepers” to ensure that
expert testimony is both scientifically valid and relevant to the case.
Application in Digital Forensics:
Courts have rejected evidence from unvalidated mobile extraction tools or
unsupported custom scripts that fail Daubert criteria.
Challenges in Applying Daubert’s Rule to Digital Evidence
1. Rapid Technological Evolution:
o New forensic tools and methods emerge faster than validation or peer review can
occur.
2. Encryption and Proprietary Systems:
o Encrypted or closed-source tools make it hard to test, reproduce, or verify results.
3. Lack of Standardization:
o Not all forensic procedures are uniformly standardized across jurisdictions.
4. Reproducibility Issues:
o Some evidence (e.g., volatile memory, live network data) cannot be easily re-
examined, challenging reproducibility.