Forensic Examination of Digital Evidence

FORENSIC EXAMINATION OF DIGITAL EVIDENCE: A GUIDE FOR LAW ENFORCEMENT
■ Evaluate general conditions of the site.
■ Determine the operating system in question.
Determine the need for and contact available outside resources, if necessary.
Establish and retain a phone list of such resources.
Processing location assessment
Assess the evidence to determine where the examination should occur. It is preferable
to complete an examination in a controlled environment, such as a dedicated forensic
work area or laboratory. Whenever circumstances require an onsite examination to be
conducted, attempt to control the environment. Assessment considerations might include
the following:
■ The time needed onsite to accomplish evidence recovery.
■ Logistic and personnel concerns associated with long-term deployment.
■ The impact on the business due to a lengthy search.
■ The suitability of equipment, resources, media, training, and experience for an onsite
examination.
Legal considerations
■ Determine the extent of the authority to search.
■ Identify possible concerns related to applicable Federal statutes (such as the Electronic
Communications Privacy Act of 1986 (ECPA) and the Cable Communications Policy
Act (CCPA), both as amended by the USA PATRIOT ACT of 2001, and/or the Privacy
Protection Act of 1980 (PPA)), State statutes, and local policies and laws.
If evidence is located that was not authorized in the original search authority,
determine what additional legal process may be necessary to continue the search (e.g.,
warrant, amended consent form). Contact legal advisors for assistance if needed.
Evidence assessment
■ Prioritize the evidence (e.g., distribution CDs versus user-created CDs).
—Location where evidence is found.
—Stability of media to be examined.
9