Digital Forensics and Incident Response

Rules of evidence

The federal rules of evidence serve as the basis by which evidence can be admitted or excluded during a criminal or civil proceeding. Having knowledge of these rules is important for the CSIRT so that any evidence collected is handled in a manner that prevents contamination and the possibility that the evidence will be barred from being seen in court:

• Rule 402: Test for relevant evidence - This rule has two parts. First, the evidence to be admitted into the proceedings would have a tendency to make the fact more or less probable than it would be without the evidence. Second, that the evidence or the facts the evidence proves is of consequence to the proceeding. This makes clear that not only the evidence should be relevant ...