Title: Evidence Handling - an overview | ScienceDirect Topics
Headings: Evidence Handling
Evidence Handling
Incident Evidence
Computer Forensics in Today's World
A Note on “Common Office Technology”
Evidence Presentation
11.3.3 Evidence Handling
Collecting and Preserving Digital Evidence
Publisher Summary
Evidence Management
Search and Seizure
Forensics Process
Prepare
Defending against MCRs
Gathering Evidence and Restoring the Machine
Tip
Case Processing
9.9.1.5 Evidence Integrity

Content: Digital evidence comes in many forms, such as application logs, network device configurations, badge reader logs, or audit trails. Given that these are only examples and depending on the scope of the investigation, there are potentially significantly more relevant evidence forms. Identifying and seizing all evidence can prove to be a challenging task to which technical operating procedures will provide guidance and support. However, from time to time, investigators might encounter situations where these technical operating procedures do not address collecting a specific evidence source. In these situations, the importance of having trained digital forensic professional is essential in having the knowledge and skills necessary to apply the fundamental principles, methodologies, and techniques of forensic science in seizing the evidence. Documentation is at the center of the investigative workflow and is equally important when it comes to seizing evidence. When a physical (ie, computer) or logical (ie, text file) artifact has been identified as relevant to an investigation, the act of seizing it as evidence initiates the chain of custody to establish authenticity by tracking where it came from, where it went after it was seized, and who handled it for what purpose. Custody tracking must accompany the evidence and be maintained throughout the lifetime of the evidence. A chain of custody template has been provided as a reference in the Templates section of this book. All digital evidence is subject to the same rules and laws that apply to physical evidence where prosecutors must demonstrate, without doubt, that evidence is in the exact and unchanged state as it was when the investigator seized it.