The primary concern of forensics experts is to collect evidence that meets well-established criteria laid down by the law. “The rules of evidence are not new for computers,” says Sean Lin, a director, Information Security Audit & Control Association (ISACA). “If digital photos are stolen, for example, we may need to prove which computer they were stored on and who copied and distributed them. In the old days, we needed to track down the people who processed and printed a roll of film. In both cases, the collection and protection of evidence must be legally acceptable. The standard of proof is the same, just the technology has changed…”
