"This title addresses the legal issues relating to digital evidence collected during the course of a criminal investigation and its subsequent use at trial. It surveys key technologies (cookies, web-cases, recovery methods) and explains them in a simple, easy to understand fashion.

Though an increasing number of criminals are using computers and computer networks, few investigators are well versed in the issues related to digital evidence. This work explains how computer networks function and how they can be used in a crime.

This report describes the results of a National Institute of Justice (NIJ)-sponsored research effort to identify and prioritize criminal justice needs related to digital evidence collection, management, analysis, and use. With digital devices becoming ubiquitous, digital evidence is increasingly important to the investigation and prosecution of many types of crimes. These devices often contain information about crimes committed, movement of suspects, and criminal associates. However, there are significant challenges to successfully using digital evidence in prosecutions, including inexperience of patrol officers and detectives in preserving and collecting digital evidence, lack of familiarity with digital evidence on the part of court officials, and an overwhelming volume of work for digital evidence examiners. Through structured interaction with police digital forensic experts, prosecuting attorneys, a privacy advocate, and industry representatives, the effort identified and prioritized specific needs to improve utilization of digital evidence in criminal justice. Several top-tier needs emerged from the analysis, including education of prosecutors and judges regarding digital evidence opportunities and challenges; training for patrol officers and investigators to promote better collection and preservation of digital evidence; tools for detectives to triage analysis of digital evidence in the field; development of regional models to make digital evidence analysis capability available to small departments; and training to address concerns about maintaining the currency of training and technology available to digital forensic examiners.

"The proposed update, as part of our "Criminal Law Series," will incorporate all major changes to digital evidence in the criminal context. Like the first edition, it will serve as a concise, clear text addressing the procedural, tactical, and strategic elements of gathering, admitting, and presenting digital evidence."--

Required reading for anyone involved in computer investigations or computer administration!

This guide is intended for use by members of the law enforcement community who are responsible for the examination of digital evidence. The guide, published as an NIJ Special Report, is the second in a series of guides on investigating electronic crime. It deals with common situations encountered during the processing and handling of digital evidence and can be used to help agencies develop their own policies and procedures. This guide is intended for use by law enforcement officers and other members of the law enforcement community who are responsible for the examination of digital evidence. This guide is not all-inclusive. Rather, it deals with common situations encountered during the examination of digital evidence. It is not a mandate for the law enforcement community; it is a guide agencies can use to help them develop their own policies and procedures. Technology is advancing at such a rapid rate that the suggestions in this guide are best examined in the context of current technology and practices. Each case is unique and the judgment of the examiner should be given deference in the implementation of the procedures suggested in this guide. Circumstances of individual cases and Federal, State, and local laws/rules may also require actions other than those described in this guide. When dealing with digital evidence, the following general forensic and procedural principles should be applied: ■ Actions taken to secure and collect digital evidence should not affect the integrity of that evidence. ■ Persons conducting an examination of digital evidence should be trained for that purpose. ■ Activity relating to the seizure, examination, storage, or transfer of digital evidence should be documented, preserved, and available for review. Through all of this, the examiner should be cognizant of the need to conduct an accurate and impartial examination of the digital evidence. How is digital evidence processed? Assessment. Computer forensic examiners should assess digital evidence thoroughly with respect to the scope of the case to determine the course of action to take. Acquisition. Digital evidence, by its very nature, is fragile and can be altered, damaged, or destroyed by improper handling or examination. Examination is best conducted on a copy of the original evidence. The original evidence should be acquired in a manner that protects and preserves the integrity of the evidence. Examination. The purpose of the examination process is to extract and analyze digital evidence. Extraction refers to the recovery of data from its media. Analysis refers to the interpretation of the recovered data and putting it in a logical and useful format. Documenting and reporting. Actions and observations should be documented throughout the forensic processing of evidence. This will conclude with the preparation of a written report of the findings.