8. Admissible- Must be able to be used in court or
elsewhere.
Authentic- Evidence must be relevant to the
case.
Complete- Must not lack any information.
Reliable- No question about authenticity.
Believable- Clear, easy to understand and
believable by a court.
IR LAW ACADEMY & RESEARCH CENTRE, NAGPUR
8
9. Find the evidence, where it is stored.
Find relevant data- recovery.
Create order of volatility.
Collect evidence- use tools.
Good documentation of all the actions
AIR LAW ACADEMY & RESEARCH CENTRE, NAGPUR
9
10. Acquisition: Physically or remotely obtaining
possession of the computer and external
physical storage devices.
Identification: This step involves identifying
what data could be recovered and electronically
retrieving it by running various Computer
Forensic tools and software suites.
AIR LAW ACADEMY & RESEARCH CENTRE, NAGPUR
10
11. Evaluation: Evaluating the data recovered to
determine if and how it could be used again the
suspect for prosecution in court.
Presentation: Presentation of evidence
discovered in a manner which is understood by
lawyers, no technically staff/management, and
suitable as evidence as determined by laws.
AIR LAW ACADEMY & RESEARCH CENTRE, NAGPUR 11
12. Disk imaging software
Hashing tools
File recovery programme
Encryption decoding software
Password cracking software
AIR LAW ACADEMY & RESEARCH CENTRE, NAGPUR 12
14. Digital forensics help to protect from and solve
cases involving:
Theft of intellectual property: This is related to
any act that allow access to customer data and
any confidential information.
Financial Fraud: This is related to anything that
uses fraudulent purchase of victims information
to conduct fraudulent transactions.
AIR LAW ACADEMY & RESEARCH CENTRE, NAGPUR 14
15. Digital evidence accepted into court must prove
that there is no tampering.
Costs- Producing electronic records and
preserving them is extremely costly.
Legal practitioners must have extensive
computer knowledge.
IR LAW ACADEMY & RESEARCH CENTRE, NAGPUR
15