Rules of evidence

The federal rules of evidence serve as the basis by which evidence can be admitted or excluded during a criminal or civil proceeding. Having knowledge of these rules is important for the CSIRT so that any evidence collected is handled in a manner that prevents contamination and the possibility that the evidence will be barred from being seen in court:

  • Rule 402: Test for relevant evidence - This rule has two parts. First, the evidence to be admitted into the proceedings would have a tendency to make the fact more or less probable than it would be without the evidence. Second, that the evidence or the facts the evidence proves is of consequence to the proceeding. This makes clear that not only the evidence should be relevant ...

Get Digital Forensics and Incident Response now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.