Digital Forensic Process—Introduction

By Rene Novoa, Senior Manager of eDiscovery and Digital Forensics

More and more aspects of our daily lives are being monitored, tracked and recorded by electronic devices.

Today, computers, smartphones and tablets can be found in almost every home and have already become obvious sources of electronically stored information (ESI) useful in both criminal and civil cases. Email, texts, documents, pictures and more wait on each of these devices to tell their stories.

Every day, more electronic devices are being added to this list. Fitness trackers, smartwatches, thermostats, video doorbells, children’s toys, air quality monitors and just about anything else you can imagine are now being used to automate, secure and entertain.

We have already seen fitness trackers used in workplace injury cases, wifi-enabled children’s toys in child custody cases and Amazon’s Echo used in a murder case. ESI from these various data recording systems has unlimited potential as electronic evidence.

The danger is that ESI is extremely fragile and can easily be tampered with, modified or lost entirely. Any of these scenarios can occur and has occurred both with and without intention. Following an established protocol that finds and protects digital evidence is essential for successful admissibility of that evidence.

This is the introduction of a five-part series focusing on proper process for digital forensics. These articles will:

• Define each step along the digital forensic path
• Explain responsibilities for a digital forensic expert
• Explain what actions your agency, firm or company can take with each step in mind to ensure the best outcome for your case, while also minimizing cost and time

Here are the steps of the digital forensic process that we will be explaining in detail in coming articles:

1. Identification
2. Preservation / Collection
3. Analysis
4. Presentation
5. ESI Review
6. Returning evidence

Click for your lesson in Identification!