Computer Forensics: Admissibility of Evidence in Criminal Cases

By Wegman, Jerry | Journal of Legal, Ethical and Regulatory Issues, January-July 2005 | Go to article overview

Computer Forensics: Admissibility of Evidence in Criminal Cases


Wegman, Jerry, Journal of Legal, Ethical and Regulatory Issues


ABSTRACT

Computers and the Internet have become a pervasive element in modern life. This technology is also used by those who engage in crime and other misconduct. Effective investigation of these offenses requires evidence derived from computers, telecommunications and the Internet. The need for digital evidence has led to a new area of criminal investigation: Computer Forensics. Forensic investigators identify, extract, preserve and document computer and other digital evidence. This new field is less than fifteen years old, and is rapidly evolving. Education in this field has focused largely on its technical aspects. However, there are significant legal issues and ethical problems that investigators must deal with. Failure to follow proper legal procedure will result in evidence being ruled inadmissible in court. As a result, a guilty criminal might go free. Failure to behave in an ethical manner will erode public confidence in law enforcement, making its job more difficult and less effective.

This paper will provide an introduction to the most significant legal issue in computer forensics: admissibility of evidence in criminal cases. The law of search and seizure, as it relates to digital equipment, will be reviewed. Interception of electronic communications and accessing stored digital information will be examined. Public policy in the form of federal legislation will be discussed. Finally, ethical concerns will be considered.

INTRODUCTION

On December 17, 2003 CSO (Chief Security Officer) Magazine predicted that "cybercrime will only get worse" (CSO 2003). On January 22, 2004 the Federal Trade Commission reported that in 2003 complaints of identity theft alone exceeded half a million (FTC 2004), up 40% from 2002. The Computer Security Institute's 2003 CSI/FBI Computer Crime & Security Survey reported that losses continued to climb and that "90% of respondents (primarily large corporations and government agencies) detected computer security breaches within the last 12 months" (CSI/FBI 2003).

The antidote to this problem is effective investigation and prosecution. Critical evidence needed to convict cyber-criminals is located on computers, networks and the Internet. However, this evidence is often difficult to obtain. It may have been deleted, overwritten, encrypted or hidden in a vast database (Schultz 2001). Nevertheless, cyber-detectives have developed techniques to salvage such information. A new investigative specialty has thus emerged: "Computer Forensics". This term, first used in 1991, refers to the identification, extraction, preservation and documentation of computer based evidence (Armstrong 2000).

An important legal challenge faces cyber- investigators: not only must they discover incriminating evidence they must also do it in a lawful manner. Otherwise, the evidence will not be admissible in court. As Marcella and Greenfield point out, an investigator "should always conduct the investigation as if you are going to trial, just in case you have to" (Marcella and Greenfield 2002).

Investigators must have a working knowledge of legal issues involved in computer forensics. They must know what constitutes a legal search of a stand-alone computer as opposed to a network; what laws govern obtaining evidence and securing it so that the chain of evidence is not compromised; what telecommunications may lawfully be intercepted or examined after they have been received; what legally protected privacy rights employees and other individuals possess. This paper will address all these concerns.

Because computer forensics is such a new field, investigative and legal norms are just now emerging. Little has been written about the legal requirements for admissibility of computer forensic evidence, or about the ethical and regulatory issues related to this new field. First we will examine the admissibility of evidence in a criminal prosecution, both with and without a search warrant. …

The rest of this article is only available to active members of Questia

Sign up now for a free, 1-day trial and receive full access to:

  • Questia's entire collection
  • Automatic bibliography creation
  • More helpful research tools like notes, citations, and highlights
  • Ad-free environment

Already a member? Log in now.

Notes for this article

Add a new note
If you are trying to select text to create highlights or citations, remember that you must now click or tap on the first word, and then click or tap on the last word.
One moment ...
Default project is now your active project.
Project items

Items saved from this article

This article has been saved
Highlights (0)
Some of your highlights are legacy items.

Highlights saved before July 30, 2012 will not be displayed on their respective source pages.

You can easily re-create the highlights by opening the book page or article, selecting the text, and clicking “Highlight.”

Citations (0)
Some of your citations are legacy items.

Any citation created before July 30, 2012 will labeled as a “Cited page.” New citations will be saved as cited passages, pages or articles.

We also added the ability to view new citations from your projects or the book or article where you created them.

Notes (0)
Bookmarks (0)

You have no saved items from this article

Project items include:
  • Saved book/article
  • Highlights
  • Quotes/citations
  • Notes
  • Bookmarks
Notes
Cite this article

Cited article

Style
Citations are available only to our active members.
Sign up now to cite pages or passages in MLA, APA and Chicago citation styles.

(Einhorn, 1992, p. 25)

(Einhorn 25)

1

1. Lois J. Einhorn, Abraham Lincoln, the Orator: Penetrating the Lincoln Legend (Westport, CT: Greenwood Press, 1992), 25, http://www.questia.com/read/27419298.

Cited article

Computer Forensics: Admissibility of Evidence in Criminal Cases
Settings

Settings

Typeface
Text size Smaller Larger Reset View mode
Search within

Search within this article

Look up

Look up a word

  • Dictionary
  • Thesaurus
Please submit a word or phrase above.
Print this page

Print this page

Why can't I print more than one page at a time?

Full screen

matching results for page

Cited passage

Style
Citations are available only to our active members.
Sign up now to cite pages or passages in MLA, APA and Chicago citation styles.

"Portraying himself as an honest, ordinary person helped Lincoln identify with his audiences." (Einhorn, 1992, p. 25).

"Portraying himself as an honest, ordinary person helped Lincoln identify with his audiences." (Einhorn 25)

"Portraying himself as an honest, ordinary person helped Lincoln identify with his audiences."1

1. Lois J. Einhorn, Abraham Lincoln, the Orator: Penetrating the Lincoln Legend (Westport, CT: Greenwood Press, 1992), 25, http://www.questia.com/read/27419298.

Cited passage

Welcome to the new Questia Reader

The Questia Reader has been updated to provide you with an even better online reading experience.  It is now 100% Responsive, which means you can read our books and articles on any sized device you wish.  All of your favorite tools like notes, highlights, and citations are still here, but the way you select text has been updated to be easier to use, especially on touchscreen devices.  Here's how:

1. Click or tap the first word you want to select.
2. Click or tap the last word you want to select.

OK, got it!

Thanks for trying Questia!

Please continue trying out our research tools, but please note, full functionality is available only to our active members.

Your work will be lost once you leave this Web page.

For full access in an ad-free environment, sign up now for a FREE, 1-day trial.

Already a member? Log in now.