1.6 Forensic Science and Digital Evidence

1.6 Forensic Science and Digital Evidence

The ultimate aim of this text is to demonstrate how digital evidence can be used to reconstruct a crime or incident, identify suspects, apprehend the guilty, defend the innocent, and understand criminal motivations. Forensic Science provides a large body of proven investigative techniques and methods for achieving these ends that are referenced extensively in this text. By forensic we mean a characteristic of evidence that satisfies its suitability for admission as fact and its ability to persuade based upon proof (or high statistical confidence). Strictly speaking, Forensic Science is the application of science to law and is ultimately defined by use in court. For instance, the scientific study of insects has many applications including the study of insects on a decaying corpse - forensic entomology. Entomological evidence has been accepted in courts to help determine how long a body has been exposed to fauna in a specific area. Another example of forensic science is using shoe prints left at a crime scene to locate the source of the impressions. Different kinds of shoe prints on flat surfaces can be preserved using chemicals or electrostatic lifting devices, and impressions made in soil can be preserved using dental stone as shown in Figure 1.3. Forensic examiners use characteristics of these shoe prints to determine the type of shoe and ultimately to associate the impressions with the shoes that made them.

Figure 1.3: Shoe prints preserved using dental cement.

Similarly, the scientific study of digital data becomes a forensic discipline when it relates to the investigation and prosecution of a crime.

In Forensic Science, certainty is a word that is used with great care. We cannot be certain of what occurred at a crime scene when we only have a limited amount of information. Therefore, we can generally only present possibilities based on the limited amount of information.

This strict definition will disappoint readers whose work does not usually lead to prosecution, such as implementing a company's sexual harassment policy or investigating security incidents. Although prosecution is not always the goal of such investigations, they sometimes result in legal action. Therefore, it is important to handle digital evidence in such cases as if it were going to be used in a court of law. Furthermore, any investigation can benefit from the influence of Forensic Science. In addition to providing scientific techniques and theories for processing individual pieces of digital evidence, Forensic Science can help reconstruct crimes and generate leads. Using the scientific method to analyze available evidence, reconstruct the crime, and test their hypotheses, digital investigators can generate strong possibilities about what occurred.

To encourage corporate digital investigators to apply the principles of Forensic Science presented in this text, a broader definition of Forensic Science will be adopted. For the purpose of this text, Forensic Science is the application of science to investigation and prosecution of crime, or the just resolution of conflict.