Digital Forensics and Incident Response - Second Edition

Rules of evidence

Federal rules of evidence serve as the basis by which evidence can be admitted or excluded during a criminal or civil proceeding. Having knowledge of the following rules is important for CSIRT members so that any evidence collected is handled in a manner that prevents contamination and the possibility of the evidence being barred from being seen in court:

• Rule 402—Test for Relevant Evidence: This rule has two parts. First, the evidence to be admitted into the proceedings must have a tendency to make a fact more or less probable than it would be without the evidence. Second, the evidence (or the facts the evidence proves) is of consequence to the proceedings. This makes clear that not only should the evidence be relevant ...