What Is Digital Evidence and Why Is It Important in 2021?

Digital evidence, also known as electronic evidence, offers information/data of value to a forensics investigation team. Every piece of data/information present on the digital device is a source of digital evidence. This includes email, text messages, photos, graphic images, documents, files, images, video clips, audio clips, databases, Internet browsing history etc.

With the dependence on electronic media and IoT devices, the risks and vulnerabilities associated with digital devices are also high. E.g., cybercriminals can launch a malware campaign by infecting a computer with a virus to further their malicious intent. Here, digital forensics experts’ role in identifying and preserving evidence gathered from the digital device during a criminal investigation is paramount.

This article explains digital evidence, its types, and how you can pursue a career in this field.

What is Digital Evidence?

As explained in the above section, digital evidence is best described as the data generated or found on any electronic device such as mobile phones, computers, smart TVs etc. Every electronic device combined with IoT technology is a potential source of digital evidence and is crucial to forensic investigations. Forensics experts gather, identify and preserve the evidence from these sources to track the perpetrators of the crime and present them in a court of law. Additionally, pieces of digital evidence prove useful in corroborating a timeline of events.

A digital forensic examiner must consider a variety of types of evidence. We shall discuss a few.

1. Analogical Evidence

Analogical evidence can prove helpful in scenarios with limited information or credible evidence to present during the investigation. By drawing comparisons between two similar cases, analogical evidence can lend credibility during a formal argument; however, it cannot be shown in court as proof.

2. Anecdotal Evidence

Anecdotal evidence loosely translates to accounts or stories by people to a specific incident or event. However, such testimonies do not hold valid in a court but can be used as supporting theory to grasp better or analyze a situation.

3. Circumstantial Evidence

Circumstantial evidence is evidence not drawn from direct observation of a fact in issue. It depends on inferences from a series of facts to draw conclusions in connection with the crime. This evidence is indirect evidence. For example, when investigators retrieve an audio clip about someone expressing their wish to commit a crime before a crime occurs, or some inferences can be drawn from someone’s search history on the web related to the crime. But this is not a direct observation of the crime as it is being committed.

4. Character Evidence

Character evidence is considered as a testimony that validates a person’s actions on a specific depending on the character of that person. Character evidence is handy to prove intent, motive, or opportunity.

5. Digital Evidence

Today, digital evidence has multiple sources, starting from email, text messages, hard drives, social media accounts, audio and video files, smart TVs etc. Therefore, digital data sourced from electronic media and Internet devices is an important link in solving crimes.

Types of Digital Evidence or Proof

In a court of law, evidence is of supreme importance; it is crucial to establish facts. Data or relevant information from electronic devices is pulled from two types of sources.

• Volatile or non-persistent: Hard disks and removable devices are a few examples of volatile data devices, which means that data is not accessible when they are unplugged from the computer. Further, data can be deliberately erased or wiped from these devices, to destroy evidence. Of course, Volatile also refers to memory that relies on power to store its contents, such as RAM chips. When the power is switched off, the memory contents are lost.
• Non-volatile, which is persistent: Persistent data is stored permanently in memory, and a loss in power doesn’t erase its content. For example, data stored in flash memory, ROM (Read-only memory), CD/ DVD, or tape.

Forensics investigation is incomplete without digital evidence. Digital data or information stored in electronic devices are associated with e-crime – another word for cybercrime. In the digitalization era, every Internet-enabled electronic device like a smartwatch, smart TV, video game console etc., can be a key component in gathering information to crack a case.

Additionally, the five rules of gathering digital evidence that every forensic expert should keep in mind are that digital evidence should be: admissible, authentic, complete, reliable, and believable. Hence, skilled individuals trained in this field need to handle the digital evidence, which brings us to the next section.

How to Conduct Digital Evidence Acquisition and Analysis

Digital forensics experts gather digital evidence to identify and analyze the case. Based on the type of electronic or digital device, forensic experts decide on their digital acquisition method. While containing the spread of cybercrime is the primary step after a cyberattack, gathering and analyzing digital evidence comes next.

One of the key points to note while handling digital evidence is to isolate the evidence source after seizing the available electronic media. Acquisition of digital data follows forensic principles and procedures. Moreover, forensic analysts need to isolate and store the digital data gathered from the evidence to maintain its authenticity and integrity. Tampered data or evidence is not admissible in a court of law. Next, analyzing the evidence for crucial information is important after creating a forensic image of the electronic media for examination.

While following proper procedures are crucial, digital forensics investigators face many obstacles.

Challenges of Digital Evidence

Acquiring digital evidence is not free of challenges. Only experts with the appropriate skillset and training are qualified to collect digital evidence. It is different from gathering physical evidence, and therefore, handling the digital acquisition of data is not free of risks.

Data stored in electronic media is volatile and is subject to changes or modifications. For example, a software update can change the data in the phone, or suspects can delete their data from the cloud or use the wipe-clean feature on their phones to remove any evidence. Consequently, this can prove tricky for investigators in carrying out the investigation. Besides, examining the massive volumes of data extracted from electronic media or devices is also a tedious task and requires the expertise of a skilled expert.

A forensic expert must be updated on the latest technological changes to be able to analyze and document the evidence. With the changes in big data and the latest technology updates, forensic experts need to be skilled in extracting data from multiple sources without modifying them and preserving the source of evidence for authenticity and integrity.

So, if you have a passion for solving crimes and analyzing evidence to track the perpetrators of cybercrime, the branch of forensic science is right for you. There is a need for cybersecurity specialists trained in digital forensics, which brings us to the last section of the article.

How to Get Certified in Forensic Science

As mentioned earlier, there is a significant demand for digital forensics analysts trained in industry-specific skills. Every organization needs digital forensics investigators to recover lost or stolen data in case of a data breach. Moreover, mapping your workforce to the right skill set is crucial to handle digital data acquisitions.

Hence, a credible course like EC-Council’s Computer Hacking Forensic Investigator (C|HFI) certification helps participants gain the necessary skills. The program highlights the various stages of collecting digital evidence — identification, collection, acquisition, and preservation and equips students with the industry-relevant skills and latest resources to tackle real-world scenarios.

The scope of the C|HFI program is enormous, and one can apply for various job roles such as Forensic Analyst. Forensic Accountant, Cryptographer, Information Security Analyst, Mobile Forensics Examiner, Computer Crime Investigator etc. According to PayScale, the average salary of a CHFI is $96k per year.

---