Griffin Forensics eForensics and Data Recovery
Handling Digital Evidence Are there computers, mobile phones or other digital devices involved in your latest case? Many cases now contain multiple digital exhibits and with this comes a wealth of data which may help your client but how should you handle it, who should examine it and what can you expect to get IT departments are primarily responsible for supporting a business’s infrastructure and computer stores fix and sell computers. They will usually not have staff who are forensically trained and they will not have the technical capability, hardware or software to deal with the forensic examination of digital media. There is a very real danger, due to the fragile nature of data, that by using non-trained staff you will lose valuable evidence either because it is accidentally deleted or overwritten, missed completely or ruled inadmissible by the court owing to procedural failings. All digital examinations should be conducted in ccordance with the principles within the Association of Chief Police Officers Good Practice Guide for Digital Evidence.
On computer media such as hard drives digital forensic examiners can view active (or live) files, deleted files, slack space and free space. You may be familiar with these terms but if not: � Active files – live data which has not been deleted and is generally accessible and visible to a user; � Deleted files – If a subject knows there are incriminating or sensitive files on the computer media they may delete them and many computer users think that this actually irretrievably 'deletes' that information. Depending on how the files are deleted a forensic examiner may be able to recover all or part of the original data. � Slack space - The areas of disk between the end of the live data and the end of its’ allocated area on disk; � Free space - File clusters that are not currently used for the storage of live files but which may contain data which has been 'deleted'. Free space may contain complete files or fragments of files.