tampering of evidences. The goal of these instruments is to ensure digital evidence remains admissible
in court and supports effective and fair investigations.
Considering the above international standards, we can observe that preceding the investigation and
examination of electronic evidence, there's a method called 'forensic triage' gaining attention in
forensic and law enforcement circles. It encompasses various processes, tools, and methodologies
aimed at prioritizing digital forensic investigations more effectively. However, it's important to note
that forensic triage isn't suitable for every case and should be used alongside proper risk assessment
by trained individuals.
When employing digital triage techniques, it is important to balance rapid identification of material of
interest with the risk of stopping further analysis, potentially missing exculpatory or more significant
material. For example, in a case involving the downloading of indecent images and child abuse,
keyword and hash set analysis can quickly identify known indecent images. However, relying solely on
triage results may lead to overlooking more serious offenses. Therefore, digital triage should be seen
as an early investigation technique aiding informed decisions rather than the sole investigative method.
2.1 Handling Electronic Devices
Digital evidence professionals are advised to uphold high standards in collecting and handling digital
evidence, regardless of whether they're involved in criminal or civil cases. Improper handling of digital
data can lead
to challenges regarding the destruction of data and the employment of inadequate
practices10.
Following Association of Chief Police Officers Guidelines (ACPO guidelines)11 is crucial to ensure
proper handling of electronic evidence, considering its volatile and easily alterable nature. The
principles stress the importance of preserving data integrity, competence in accessing original data,
10
11
Stanford International Bank Limited (in liquidation) v. Hamilton-Smith, High Court (Antigua),
See :
https://ag.vlex.com/vid/alexander-m-fundora-applicant-805812073
Williams, Janet. "Acpo good practice guide for digital evidence." Metropolitan Police Service, Association of chief police
officers, GB (2012): 1556-6013., Good Practice Guides for Digital Evidence (the latest of five revisions coming in 2012, the first
being in 1998 [2]) are considered to provide core information for practitioners operating in the digital forensics field in England and
Wales. The,Principle 1, No action taken by law enforcement agencies, persons employed within those agencies or
their agents should change data which may subsequently be relied upon in court. Principle 2, In circumstances
where a person finds it necessary to access original data, that person must be competent to do so and be able to
give evidence explaining the relevance and the implications of their actions. Principle 3, An audit trail or other
record of all processes applied to digital evidence should be created and preserved. An independent third party
should be able to examine those processes and achieve the same result, Principle 4: The person in charge of the
investigation has overall responsibility for ensuring that the law and these principles are adhered to.
9