What is Digital Evidence?

Digital Evidence is a digital object that contains reliable information that supports or refutes a hypothesis.

Digital Investigation is a process where we develop and test hypotheses that answer questions about digital events. This is done using the scientific method ¨C we develop a hypothesis using evidence that we find and then test the hypothesis by looking for additional evidence that proves or disproves the original hypothesis.

Technology is moving fast; perhaps too fast for some. Years ago, law enforcement agencies and lawyers were not hampered with the mass of evidence that results from email, instant messenger chat logs, spreadsheets and the like. In a litigation case, lawyers have a method of getting around that problem; they politely ask for each clients' relevant documents and examine them using keyword searches.

What would happen if they found out that the evidence collected in the case had been retrieved in an unreliable way? What if there were further, potentially crucial documents that existed that they would never know about? Would they know if the documents they had in their possession had been tampered with?

Digital evidence can be very compelling. Because people are often much less careful in email exchanges than they might be when composing a letter that is printed on the corporate stationery, corporate email can be an especially valuable source of evidence in litigation. And there are many other avenues where forensic analysis can yield useful digital evidence.