Digital Forensic Evidence in the Courtroom: Understanding Content and Quality

With the widespread permeation of continually advancing technologies into our daily lives, it is inevitable that the product of those technologies, i.e. digital information, makes its way into the courtroom. This has largely occurred in the form of electronic discovery, or “e-discovery,” where each party involved in an action provides the relevant information they possess electronically. However, in cases where information is hidden, erased, or otherwise altered, digital forensic analysis is necessary to draw further conclusions about the available evidence. Digital forensic analysis is analogous to more traditional forensic analysis. For example, in criminal cases where a firearm was used in the commission of the crime, but the gun is not readily admissible, forensic science is necessary to trace the origin of the weapon, perform fingerprint analysis on it, and compare fired bullet casings to ensure the weapon used and the weapon analyzed are one and the same. In sum, digital forensics is the preservation and analysis of electronic data. These data include the primary substantive data (the gun) and the secondary data attached to the primary data, such as data trails and time/date stamps (the fingerprints). These data trails and other metadata markers are often the key to establishing a timeline and correlating important events