iPhone Forensics

Rules of Evidence

In both civil and criminal cases, five general rules are used to weigh the value of evidence. These five rules are:

Admissible

Evidence must have been preserved and gathered in such a way that it can be used in court. Many different errors can be made that could cause a judge to rule a piece of evidence as inadmissible. These can include failure to obtain a proper warrant, breaking the chain of evidence, and mishandling or even destroying the evidence.

Authentic

The evidence must be relevant to the case, and the forensic examiner must be able to account for the origin of the evidence. For example, intercepting an email transmission is not enough to prove that the alleged sender was responsible for the message. A relationship must be established between the message and the computer it was sent from. It will also need to be established, beyond reasonable doubt, that there was a relationship between the computer, the message, and the person who sent the message.

Complete

When evidence is presented, it must tell the whole story. A clear and complete picture must be presented that can account for how the evidence came to be. If unchecked, incomplete evidence may go unnoticed, which can be even more dangerous than no evidence at all. As a recent example, consider the case of a man who was charged with possession of child pornography. The evidence presented showed that the images had been downloaded onto the man’s work computer, but it wasn’t until much later in the case that ...