Introduction
Digital devices are everywhere in today’s world, helping people communicate locally and globally with ease. Most people immediately think of computers, cell phones and the Internet as the only sources for digital evidence, but any piece of technology that processes information can be used in a criminal way. For example, hand-held games can carry encoded messages between criminals and even newer household appliances, such as a refrigerator with a built-in TV, could be used to store, view and share illegal images. The important thing to know is that responders need to be able to recognize and properly seize potential digital evidence.
Digital evidence is defined as information and data of value to an investigation that is stored on, received or transmitted by an electronic device1. This evidence can be acquired when electronic devices are seized and secured for examination. Digital evidence:
- Is latent (hidden), like fingerprints or DNA evidence
- Crosses jurisdictional borders quickly and easily
- Can be altered, damaged or destroyed with little effort
- Can be time sensitive
There are many sources of digital evidence, but for the purposes of this publication, the topic is divided into three major forensic categories of devices where evidence can be found: Internet-based, stand-alone computers or devices, and mobile devices. These areas tend to have different evidence-gathering processes, tools and concerns, and different types of crimes tend to lend themselves to one device or the other.
1 Electronic CSI, A Guide for First Responders, 2nd edition, National Institute of Justice, April 2008