Digital evidence

Definition

Digital evidence is

“

[i]nformation stored or transmitted in binary form that may be introduced and relied on in court.

”

Overview

Digital evidence is acquired when data or electronic devices are seized and secured for examination.

Digital evidence —

• Is latent, like fingerprints or DNA evidence.
• Crosses jurisdictional borders quickly and easily.
• Is easily altered, damaged, or destroyed.
• Can be time sensitive.

Digital evidence is fragile and can easily be lost. For example:

• It can change with usage.
• It can be maliciously and deliberately destroyed or altered.
• It can be altered due to improper handling and storage.

Digital evidence of specific cybercrimes

The following is a list of crimes which may involve the use of a computer or other electronic media. Listed below are the crimes and potential evidence which may be recovered from various types of digital evidence.

See also

• Best Practices for Seizing Electronic Evidence
• Cybercrime
• Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors
• Electronic evidence
• Electronic Evidence Compliance: A Guide for Internet Service Providers
• Good Practice Guide for Computer-Based Electronic Evidence
• Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations