Computer Forensics For Dummies®

Chapter 2. Suiting Up for a Lawsuit or Criminal Investigation

In This Chapter

• Decoding legal codes

• Managing the discovery of e-evidence

• Operating in good faith

• Paying for the e-evidence

Investigators routinely deal with fingerprints, skid marks, bloodstains, bullets, burned buildings, and other traces left by criminals that connect them to the crime scene. What these types of physical evidence may have in common with electronic evidence is that they have no eyewitnesses. When no one has seen or heard a crime in progress to give direct evidence about what they saw or heard, the evidence speaks for itself — so to speak — with the help of experts. It can carry more weight and credibility in a case than direct, eyewitness testimony.

E-evidence is also powerful because it has perfect memory and no reason to lie, and it can't be eliminated or intimidated by a Smith & Wesson weapon. The Achilles heel of e-evidence is that the lawyers, judges, and juries who are involved in the case may not understand the technological details and, as a result, not appreciate the relevance of the e-evidence — at least not until you fluently translate between technology and legal terms so that they can understand.

In this chapter, you find out how rules of evidence, legal procedures, and e-discovery processes converge to create admissible e-evidence — or why it fails to do so.

Deciphering the Legal Codes

Laws of evidence play a big role in the career of every type of investigator. The concept of relevancy is the ...