Criminal Justice
1. You are a digital forensic examiner and have been asked to examine a hard drive for potential evidence. Give examples of how the hard drive (or the data on it) could be used as (or lead to the presentation of) all four types of evidence in court. If you do not believe one or more of the types of evidence would be included, explain why not.
A. Testimonial Evidence – Testimony or a statement provided by an individual detailing what they observed or experienced (through any of their senses). For example, a witness may have heard tires screech and a loud crash but not actually have seen the accident. In this example, even though he didn’t actually see the crash, witness’s testimony is still valuable – it can help pinpoint the time of a crash, determine the number of vehicles involved, or speak to the lighting conditions or weather conditions were at the time of the accident. Testimonial evidence can be significant as either direct or corroborating evidence. In addition, expert testimony can be provided that allows a subject matter expert (vetted and accepted by the court) to offer opinions and interpretations (e.g., context) of other evidence that has been or will be presented.
B. Real Evidence – Physical evidence. Examples would be a murder weapon, a hard disk drive, fingerprints, blood or other bodily fluids, clothing, stolen property, etc.
C. Documentary Evidence – Documents (such as records, checks, or photographs) that are like real evidence in that it may be a physical item (e.g., printed material), but documentary evidence is also the results of the analysis of documents or records to show a pattern of behavior. For example, you examine (and create) potential documentary evidence each time you balance your checkbook.
D. Demonstrative Evidence – Evidence that utilizes or requires a demonstration, such as the use of a chart or map, to help prove what happened. Demonstrative evidence is most often created by an expert witness; an example might be using a dummy to show how a person was standing when he was shot, or it could be a flow chart showing how money was moved between different accounts.
2. You have been asked to assist a law enforcement team serving a search warrant related to a child pornography investigation. You are the digital forensic expert for the team, and, as such, have been assigned the task of identifying and collecting the digital evidence at the search location.
A. What steps should you take before the search?
B. For what types of evidence should you be alert when searching the residence?
C. What types of items would you seize?