accessing original data are competent and can explain their actions, creating and preserving an audit
trail of all processes applied to digital evidence and ensuring that the person in charge of the
investigation upholds the Evidence law and these principles. When dealing with networked systems,
it's essential to understand the topology and sources of digital evidence across various locations. The
process of copying electronic evidence should aim to produce an exact replica without altering the
original data. Hashing processes are used to verify the authenticity of copied files.
Maintaining the quality of copied digital files is crucial, as highlighted in legal cases like The Gates Rubber
Company v Bando Chemical Industries Limited12, where the mishandling of evidence led to its loss of
probative value in court. Digital evidence professionals must sometimes make decisions based on
principles of good practice, especially in unique situations like live banking systems. Examining the
surrounding area of the scene can also yield relevant materials for disclosure or criminal investigations,
complementing the digital evidence gathered. This example illustrates that a loss of evidence
dependability can lead to significant challenges for the concerned party, which may not always be
adequately addressed in every situation.
2.5 Preserving Electronic Evidence
Electronic evidence must undergo validation to ensure its probative value. Digital evidence
professionals routinely copy data from various disks or storage devices, necessitating measures to
prove the integrity of the duplicated evidence. Electronic fingerprinting, a cryptographic technique,
associates a unique identifier with each file or storage device, enabling verification of data integrity at
the time of collection.
The continuity of custody is crucial in preserving electronic evidence, requiring meticulous
documentation of its collection, storage, and handling to demonstrate integrity and prevent tampering.
When transporting and storing hardware and digital evidences, precautions must be taken to protect
against damage or data corruption, which may be caused by
factors like temperature, humidity, and
magnetic effects.
The emergence of cloud computing presents complex challenges for digital forensics, as evidence
stored in the cloud is distributed across multiple servers and managed automatically. Retrieving such
evidence may require cooperation from service providers, raising jurisdictional issues. Forensic triage
12
United States Court of Appeals, Tenth Circuit, 9 F.3d 823 (10th Cir. 1993)
11