1.7 Summary

Digital evidence exists in abundance on open computer systems, communication systems, and embedded computer systems. A hard drive can store a small library, digital cameras can store hundreds of high-resolution photographs, and a computer network can contain a vast amount of information about people and their behavior. At any given moment, private telephone conversations, financial transactions, confidential documents, and many other kinds of information are transmitted in digital form through the air and wires around us - all potential sources of digital evidence. Even crimes that were not committed with the assistance of computers can have related digital evidence, including homicide, arson, suicide, abduction, torture, and rape.

Given the widespread use of computers and the wide use of networks, it would be a grave error to overlook them as a source of evidence in any crime. Computers should be collected in all criminal, civil, and corporate internal investigations and the cybertrail should be followed routinely. Also recall that privately owned networks may have more sources of digital evidence than the global Internet, detailed monitoring of individuals' activities, and a higher concentration of digital data per unit area.

Although there are many challenges to dealing with evidence stored on and transmitted using computers, we must not be daunted. Criminals will be especially eager to use computers and networks if they know that attorneys, forensic examiners, or computer security professionals are ill equipped to deal with digital evidence. Therefore, anyone who is involved with criminal investigation, prosecution, or defense work should be comfortable with personal computers and networks as a source of evidence. One of the major aims of this work is to educate students and professionals in the computer security, criminal justice, and forensic science communities about computers and networks as a source of digital evidence.

Education can only bring us so far. Ultimately, all of these groups must work together to build a case and bring offenders to justice. In addition to learning how to handle digital evidence, law enforcement officers must know when to seek expert assistance. Similarly, computer security professionals must know when to call law enforcement for assistance. Attorneys (both prosecution and defense) must also learn to discover digital evidence, defend it against common arguments, and determine whether it is admissible. Forensic computer examiners must continually update their skills effectively to support investigators, attorneys, and corporate security professionals in an investigation.