Preserving and Protecting Computer Evidence

Introduction

The new technology has fostered a reliable way of preserving and protecting computer evidence. Information can now be saved on computers and many other types of electronic media, disguised, and at another point, it can be “erased.” It is much easier to find evidence in electronic devices than paper documents or other tangible records. This paper will cover how computers and other electronic devices safeguard, preserve, and protect computer evidence from theft or damage.

Harsh Code

The hash codes can protect and verify computer evidence (Electronic Evidence Retrieval, LLC, n.d.) A hash code is a formula that mathematically promotes the provision of a unique result or outcome when a computer file is applied. In most instances, harsh codes promote integrity, especially in forensic processes. Through the imaging process, the harsh code for each sector of the suspect disk is calculated several times. It is calculated on the original disk before imaging, on the image file after imaging, and once more on the original disk after imaging. For the image to be legitimated, all three must be identical. A new image must be taken if the image’s hash code does not match the hash code of the original drive. In most cases, hash codes are used to promote, protect and preserve the forensic process integrity.

The procedure of Protecting and Preserving Computer Evidence

In any case of suspicion of the presence of relevant evidence in a computer, you should do all in your power to ensure that any pertinent data remains unaltered. This happens because it is in human nature that makes them want to check out potential proof, yet doing so increases the chances of computer spoliation, such as inadvertent spoliation, deliberate software spoliation, and hardware spoliation. In this case, computer disconnection from power is advised if there is any cause to think it might be a trap to destroy data if it is not shut down in a specific way while it is running (Electronic Evidence Retrieval, LLC, n.d.).

Second, a trained computer forensic expert should be consulted. This is an important step since it enables the expert to explain to the attorney where the forensic image of the computer may be important to the court of law. Recently the courts are embracing and recognizing the role of retaining some experienced and well-trained forensic specialists. Third, the opposing party should be informed not to use the computer and not to alter or delete any data (Electronic Evidence Retrieval, LLC, n.d.). This includes not changing the computer, such as adding new files, running secure deletion tools, or installing new software. Lastly, it is crucial to detail all information to the forensic expert. Expert technicians with the right training and experience have methods for searching and inspecting the drive. Computers, especially in a criminal case, should be handled with care by isolating them to avoid contamination and calling forensic science specialists to conduct the investigation as soon as possible.

How to Protect and Preserve Computer Evidence through avoiding Spoliations

Inadvertent spoliation occurs when computer users accidentally or occasionally delete important files and neglect to back them up. Software spoliation, on the other hand, is also involved in deliberate file deletion in a computer. Hardware spoliation occurs when a computer’s hard drive is accidentally corrupted, which promotes data and file loss (Electronic Evidence Retrieval, LLC, n.d.). In these scenarios of spoliation, computer files and data can still be retrieved by computer software. Also, forensic experts can recover deleted data from a computer. Occasionally, some computers may attempt to change and interfere with files, which changes the significant dates. This challenge is usually dealt with by a computer’s operating system, which typically keeps track of the dates that each file was first created, last edited, and last accessed.

Conclusion

Computer software and the operating system play a huge role in protecting and preserving computer evidence, especially when spoliation occurs. Forensic experts, on the other hand, use their knowledge to promote the validity of computer files and data. Computer evidence is more accessible than tangible files, making them reliable, especially when needed.

References

Electronic Evidence Retrieval, LLC. Preserving and Protecting Computer Evidence. (n.d.) https://www.electronicevidenceretrieval.com/forensics/articles/preserving-and-protecting-computer-evidence/ (Last accessed 2023, January 27).