Digital Forensics Dispatch

If Your Case Could Involve Digital Evidence, Preserve It Now

September 26, 2019

If you find yourself in a situation where you need to present data from electronic devices in court, it is important to follow best practices involving digital evidence. The first step will be preserving the relevant data. Most forensic software has the capability to create a copy of popular devices including mobile devices, computers, tablets, USBs, CDs, and many more.

Electronic evidence as a whole has the ability to be volatile and can change or update over time. Once you realize the digital evidence may be of value, preserve the data in its original form.

If deleted data is of interest, you will want to limit the amount of new data coming on to the device prior to the preservation. When dealing with deleted data, it is often stored in the free space of the device and has the potential to be overwritten with newer data coming onto the device. Turning the device off, or placing it in airplane mode if the device has that capability, are our recommendations to help prevent overwritten data.

The preservation process begins by making a copy of the data of interest. Any analysis performed is done on the duplicate copy created. It is best to avoid altering the original form of evidence. We do not recommend self-collection. You will want to retain a specialist to have the data preserved in a forensically sound manner.

Once a forensic copy is made of the data, the device may be returned to the owner and the copy can be stored for future analysis, if required.

Email:    Phone: 703.359.0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com/services/digital-forensics