Challenges in Handling Electronic Evidence - Coursework Example

Topic:  E-Evidence Introduction: Electronic evidence is information and data of value to an investigation that is stored on, received, or transmittedby an electronic device. This evidence is acquired when data or electronic devices are seized and secured for examination.1 E-evidence is easily damaged, altered or destroyed. It is also time sensitive which is why it is advantageous that it can be transferred very quickly to any country in the world. New technologies have changed our lives, internet has seeped into our homes and offices and the time we spend on it is constantly monitored. Any data stored, exchanged, and transferred is susceptible to prying eyes. Usually people don’t realize that they are being watch on internet and any transaction they make is also observed. Since nowadays everything is done electronically it has also become important in the court of law to include these activities as valid and legal sources of evidence. A lot of information can play an important role in litigation, as most of the data is no longer printed but is stored in soft copy forms, it is necessary for this data to also come under observation. Lawyers have begun to realize the value of electronic information as they can often help them win cases. Lawyers and other investigators now face the need to develop the knowledge and skill required to turn this electronic evidence into something noteworthy. They don’t necessarily have to become computer specialists but they have to realize how to convert and manipulate the data available to help their cases. They should now how to ask the right questions, realize the importance of time sensitivity and also know how easily this electronic data can be altered or destroyed. There are actual computer forensic experts who can help anyone find out the information stored or exchanged over a particular computer. Lawyers who represent companies that have a lot of stored information on their hands need to advice their clients about how this data can be used against them as evidence. They should be shown how to prepare and use defensive measures against data investigators. Forms of electronic evidence: Email Word processors, Spreadsheets Databases Data warehouses Image files Internet browsers etc Another important point to note is that not only the data that is stored on a physical workstation is classified as e-evidence but rather every piece of information exchanged or stored online is also important data. Users of E-Evidence: Lawyers: In the court of law any piece of evidence that can be found stored online can and will be used. In order to win cases lawyers specially find more and more information online as the trend of saving data has changed. Judges: Similarly judges also have to consider electronic evidence as valid evidence and make sure that the data available is in it original format and not tampered with. Competitors: Various companies used to have spies that stole physical forms of data from other companies. Now all they need is access to emails, upcoming software, website trends etc to figure out what their competitor is up to. Government: For government agencies it is of supreme importance that all electronically transferred data is monitored. It becomes a matter of national security in some cases eve. Other than that various frauds such as insider trading, illegal monetary transactions, hacking etc can also be proved on the basis of electronic evidence. Organizations: Often employees who have access to data admit to wrong doing. Innovative storage devices have made it extremely easy for data to be stored and transferred into the wrong hands. To keep a track on employees who handle sensitive data or to convict them of any wrongdoing, e-evidence is of supreme importance. Sources of electronic evidence: Computer devices: Computer systems can take various forms, a desktop, laptop, minicomputers or mainframes. Both the software ad hardware can be used as evidence. All the data stored in the form of documents, images, internet browsing history and databases etc can be analyzed and further dissected for evidence. Storage devices: With new innovations the size of these storage devices has decreased. But no matter what the size they can still store valuable information in fact the smaller the device the easier it will be to hide or destroy. Hard drives, external hard drives, memory cards and USBs all come under storage devices. Handheld devices: Handheld devices can be classified as all mobile phones, smart phones, tablet computers and PDAs. These devices are used for communication and entertainment but the data stored on them is also used for electronic evidence. Texts, emails, voice mails, images and GPS can all contain valuable information. Network servers: All the data transferred and communication is done over servers it is therefore necessary to analyze them also to gain valuable data. Other than these devices audio recorders, video cameras, CCTV footage, mp3 players and gaming consoles also come under gadgets that can be used as electronic evidence. Importance of handling the data with care: As with fingerprints and other forensic evidence e-evidence is also latent in nature. Evidence is further derived from the information found so it is extremely important to handle it with care. Training is given to police officers and usually computer forensic experts are used to make sure the data doesn’t lose its integrity. Failure to handle data with care will lead to incorrect conclusions. Established forensic methods are supposed to be followed for e-evidence recovery to make the data acceptable in court. There are four phases of the recovery process: 1) Collection phase: In this phase the lawyer realizes that there is a need for electronic evidence and it can be found on scene. The recognition and search for evidence begins here and this is the most sensitive phase. The raw, real-time data here should be handled with utmost care so as not to tamper with it which will lead to eventual incorrect results. 2) The examination phase: This is where the evidence is made visible and analyzed as to examine its significance. Any hidden information from the data is unearthed here and the important data is classified and brought forward. Irrelevant data is separated here which is why this process is the most time consuming considering the sheer size of data available. The result of this process is the origin and significance of the data. 3) The analysis phase: Now the experts try to relate the derived information to the case. The second examination phase is what forensic experts do, now analysts come in and find out the true value of the data and analyze the possibilities of how it can be used in the case. 4) The report or statement: This phase completes the examination. Here all the processes that have taken place are reported on and outlined. This is the version that is presented in the court. An examiner may also be called upon by the court to ask about the conduct of examination and to verify his credentials. Challenges in handling electronic evidence: Document request: Not all the data is accessible by everyone, a warrant will be required to be granted access to the data equipment. Non-discoverable information: Since the data is in raw form it is up to the forensic experts to find out relevant information and further relate in to the case. Sometimes this might not be possible. Magnitude of data: A single organizations data might comprise of many gigabytes or even terabytes for major organizations. Again sifting through such a magnitude of data is a very tough and time consuming task. A client’s privilege to confidentiality: Again data might not be available to the prosecutors, or the data might be in an encrypted format. Social media and e-evidence: Social media is another aspect that has to be considered for e-evidence. Social networking has grown over the past years tremendously and the amount of information that is stored online is again a repository for investigators. A lot of people are not aware of the privacy implications that are posed online, they easily give up their personal information and all their activities are monitored. There has been an increase in divorce rates, as spouses are found to be cheating online. And their social networking advice is seen is evidence under the court of law. Paedophiles, child molesters who lure kids to meet them often use social networks to do so and this is the best way to implicate them as their activities can be monitored online. There are virtual life websites available online where people often create their fantasy life and have the ability to interact with other social members. The actions that take place in this virtual world are also investigable in courts. Following crimes can be unearthed with e-evidence: Computer fraud investigations: Any transactions that are done over networks, credit card data, e-commerce, customer information and financial assets record can all be available on computer systems. All these information can be used to find out any wrongdoing. Child abuse and pornography claim: E-evidence is the best way to capture paedophiles and other sex offenders, as they lure their victims online thinking they are safe. However with constant monitoring they are caught online or if a kidnapping has taken place their activities can be traced back. Images, movie files, internet activity logs, chat logs, emails etc all is potential e-evidence. Homicide investigations: Address books, emails, financial asset records, telephone records, photos of victims stored on computer. All are reasonable e-evidence. Financial fraud and counterfeiting investigations: This is often investigated in the case of fraudulent organizations. Their data which includes customer information, financial records, databases, fake identification, online banking software, bank logs, internet logs and credit card numbers can be analyzed further for any wrongdoing. Identity theft investigation: This is another new way of criminal fraud. A simple access to a credit card machine grants a criminal inside information about his victim’s financial assets, his whole life. In this case usually criminals make up a repository of data regarding their victims, any birth certificate, credit card number, social security numbers, scanner software, digital signatures and many more files can be seen as e-evidence. Conclusion: E-evidence has grown to become increasingly important in the court of law. The amount of information that is stored online can prove to be a lethal substance as they often contain incriminating proof. It has become a necessity for anyone from an individual to a whole organization to use computer systems and internet, so at the end of the day each and every person can be traced back to their activities online. Various criminal activities like fraudulent transactions, insider trading, pornography etc can no easily be proved by e-evidence. Computer forensics has become a booming trade as it is important to unearth data and then further analyze it to make it applicable in the criminal case. In this new age of technology, with every step being monitored, it is easy to find incriminating data online and that data has great importance. References: National Institute of Justice (U.S.). (2008). Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition, April 2008. S.l: s.n. Gahtan, A. M. (1999). Electronic evidence. Scarborough, Ont: Carswell United States., & United States. (2000). Best practices for seizing electronic evidence: A pocket guide for first responders. Washington, DC: U.S. Dept. of Homeland Security, United States Secret Service. Association of Chief Police Officers of England, Wales & Northern Ireland., & National Hi-Tech Crime Unit (Great Britain). (2003). Good practice guide for computer based electronic evidence. London?: Association of Chief Police Officers. Read More