REFLECTIONS 1
Maintaining evidence integrity is one of the most important steps in the digital forensic investigation.
Provide some examples of how the integrity of evidence can be discredited during a digital forensic
investigation. What are some ways that law enforcement can ensure that evidence integrity is
maintained during a digital forensic investigation?
According to the lecture notes “Legal challenges in digital forensic investigations,” focuses on
the process of evidence presentation in court, and the laws that affect what is admissible and when by an
analyst. In the lecture notes, (Holt et al,) defined admissibility as the process of determining whether
evidence will assist the fact finders (e.g., judge) through their decision-making process. The judge
determines whether the digital evidence is admissible in court-based on relevance and reliability. The
evidence is considered relevant when it can make the fact presented in a case probable, with reliability
referring to the accuracy of the evidence deemed relevant to a case.
REFLECTIONS 2
Based on the lecture notes above, it could be deduced that, during a forensic investigation, it is important
to maintain the integrity of the system for use in the forensic examination. The judgmental preservation of
evidence is a basic principle upon which investigators should base the examinations and the investigation
processes. During forensic investigation, some of the integrity concerns like the validation of the evidence
collected leave the investigators with many questions. The forensic evidence which cannot be digitally
proven through the digital process is discredited on the validity. To the evidence that do not preserve the
digital standards can be easily discredited in the forensic evidence gathering. The standard placed for the
forensic evidence is important and must abide by the law enforcement policies in investigation
approaches.
Digital evidence supports the investigation and in the performance of the digital forensics the investigator
must forensically collect and prove the facts. The evidence collected violating the approaches and policy
indicate the situational approaches to handle variety information extracted from forensic devices. Digital
evidence may contain both incriminating and exculpatory evidence that cannot be processed
electronically (Nelson, Phillips, & Steuart, 2014). The forensic evidence must support the desired facts
and give specific entity in performing forensic processing of the fact.
Before discussing the facts of any case, investigator must maintain the evidence integrity. The integrity in
the context of computer forensic means that the facts collected are in compliant to the current relevant
legislation (Nelson, Phillips, & Steuart, 2014). The integrity of the evidence is maintained through a sound
understanding of the law as far as it relates to the discovery of the electronic evidence.
The forensic approaches must ensure that all the needed facts are preserved, and the process preserves
original data in the forensic sound facts. The collection of forensic evidence commenced with the
collection of the computer related evidence retained and kept at the computer operations. The facts
collected must be up to date, in line with the court order and standard and well researched with fact
presented.
REFLECTIONS 3
In conclusion, technique available assists in the computer forensics. The organized analysis gives
potential approaches to handle the evidence thus look for factors relevant to the facts in question.
Computer forensics is the only way of testing the digital evidence.
Reference
Thomas J. Holts, Adam M. Bossler & Katherine C. Cybercrime and Digital Forensics, Second Edition
Nelson, B., Phillips, A., & Steuart, C. (2014). Guide to computer forensics and investigations. Cengage
Learning.
