Forensic Computing

Documents produced electronically have an overwhelming percentage of the human community today compared to printed documents. Digital storage of documents is also mainly other conventional methods of storage and shall be transmitted largely through electronic networks and the Internet. Billions of emails are sent annually in the human communication, surpassing the traditional mail communication. All these ways of drafting documents, their storage and communication have opened new doors for abuse and criminality. The electronic environment raises new problems in penal systems worldwide. To go to court reprehensible acts, crimes and abuses committed by using digital environment is necessary to administer the court undeniable evidence of these facts. An important role in preventing and combating digital crime is gathering electronic evidence. Digital evidence has been defined as any data that can establish that a crime has been committed or can provide a link between a crime and its victim (Casey, 2000). Digital evidences, like normal (traditional) evidences, must pass the test of admissibility and weight. Admissibility is a set of legal rules applied by judges in order to allow the use of evidence in a court of law. Weight is the validity and importance of the evidence. Therefore evidence must be: admissible, authentic, complete, reliable and believable (Casey, 2011). Following these rules is essential to guaranteeing successful evidence collection. Digital forensic investigators are commonly employed to deal with such cases and they make use of principles and procedures currently employed for gathering evidence from computer, network, internet and mobile devices that are found in ACPO Good Practice Guide for digital evidence updated in March 2012. Therefore there are four principles that the first responder to the crime must follow. Principle 1: “No action taken by law enforcement agencies, persons employed within those agencies or their agents should change data