Title: Evidence Handling - an overview | ScienceDirect Topics
Headings: Evidence Handling
Evidence Handling
Incident Evidence
Computer Forensics in Today's World
A Note on “Common Office Technology”
Evidence Presentation
11.3.3 Evidence Handling
Collecting and Preserving Digital Evidence
Publisher Summary
Evidence Management
Search and Seizure
Forensics Process
Prepare
Defending against MCRs
Gathering Evidence and Restoring the Machine
Tip
Case Processing
9.9.1.5 Evidence Integrity

Content: Evidence is the foundation of every criminal case, including those involving cybercrimes. The collection and preservation of digital evidence differs in many ways from the methods law enforcement officers are used to using for traditional types of evidence. Digital evidence is intangible, a magnetic or electronic representation of information. Its physical form does not readily reveal its nature. In addition, digital evidence is fragile. It is very easy for a criminal to deliberately delete crucial evidence in an instant or for an officer or technician to unintentionally damage or destroy it. In many cases, evidence that appears to be gone is still on the disk or other media and can be recovered. A number of data recovery software packages are on the market, several of which are designed specifically for computer forensic work and are marketed with law enforcement use in mind. Once one or more duplicates have been made, the original can be locked up securely in an evidence locker or evidence room until needed. Chain of custody must be maintained throughout the entire process.