Forensic evidence and cybercrime

Abstract

This chapter introduces why forensic evidence is essential, what forensic evidence is, the categories of forensic evidence, and how forensic evidence is used to investigate cybercrimes. The general issues facing the forensic sciences that center primarily on dealing with evidence, such as admissibility, expert opinion, bias, and uncertainty, are discussed concerning cybercrime and cybercriminal investigations. Brief introductions to Daubert, Joiner, and Kumho decisions are provided to put the issues regarding evidence, including digital evidence, into the proper context. The chapter introduces digital evidence, digital forensics, and the role it plays in the investigative process. It also discusses the phases of the generic digital forensics process model that includes (1) identification, (2) collection, (3) analysis and examination, and (4) opinion/report. Two broad categories of digital evidence - trace and reconstructive - are presented to limit the scope of the chapter further, as not all the traditional types apply to this domain. The chapter also looks at what the future holds for forensic evidence in the field of cybercrime and examines some of the current and future challenges that face digital evidence and digital forensics. These include but are not limited to the volume of potential digital evidence, the variety and location of digital evidence, encryption, and the need to adopt probabilistic approaches to quantify the uncertainty of conclusions and opinions derived from digital evidence. The chapter concludes by summarizing the importance that digital evidence has to all investigations and the challenges faced by this forensic science.