Information Technology Reference
In-Depth Information
To.guard.and.maintain.the.integrity.of.electronic.evidence.
and. to. be. able. to. prove. that. what. you. are. producing. for. a.
court.or.audit.is.the.same.evidence.as.was.requested.or.was.
created.originally,.experts.will.often.begin.by.creating.a.hash.
value.of.that.evidence.before.it.is.moved.or.copied..They.use.
special.tools.that.do.not.manipulate.or.write.any.data.to.the.
device. they. are.copying.from,.and.they.carefully. document.
the.chain.of.custody.or.any.changes.that.might.have.occurred.
and.what.and.why.they.occurred.
Then.at.the.other.end.of.things,.when.they.are.produc-
ing. that. evidence,. they. can. use. the. hash. values. that. were.
recorded,. along. with. their. chain. of. custody. documentation.
to.prove.that.the.evidence.in.question.is.the.same.as.when.it.
was.created..Or.if.that.is.not.the.case,.they.can.show.why.it.
is.not.and.establish.whether.it.is.still.legitimate.and.relevant.
evidence.that.should.be.admitted.
That.last.part.probably.needs.an.example.to.make.more.
sense..Assume.you.were.asked.to.bring.to.court.a.set.of.e-mails.
that.were.created.on.a.certain.computer..Those.e-mails.were.
copied.into.a.Word.document.by.someone.with.less.expertise.
in.these.issues.and.then.deleted.from.the.original.e-mail.appli-
cation..Those.e-mails.saved.into.a.Word.document,.though.
they.lost.the.integrity.of.the.original.documents,.might.still.be.
admissible.as.evidence.if
•. You. carefully. documented. when. and. by. whom. the.
e-mails.were.copied.
•. You. can. demonstrate. how. that. Word. document. was.
protected. from. any. changes. (perhaps. by. creating. a.
hash.of.the.document).
•. You.did.everything.in.your.power.to.attempt.to.recover.
whatever.you.could.from.the.e-mail.application.
If. the. courts. feel. they. are. important. enough. and. there. is.
good.documentation.establishing.that.the.core.text.was.not.
changed,.the.e-mails.might.be.admitted.
