Dealing with computerised evidence

The overriding principle concerning all phases of seizing and processing electronic evidence i.e. seized computers, disks and other media, should be never to alter the evidence from its original state. This should ensure its admissibility in court or other legal proceedings. The processing officer should carefully document every step taken while processing the electronic evidence. All seized computer hard disks, diskettes or other media should be “write protected” because electronic media that has been “write protected” cannot be altered or erased either intentionally or accidentally. A “bit-stream” identical copy of all hard drives, diskettes or other media must be made prior to any processing…

More (Financial Express)

Leave a Comment

Latest Videos

Quantifying Data Volatility for IoT Forensics With Examples From Contiki OS

Forensic Focus 22nd June 2022 5:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...