Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

37 summary 81 The risk of confusion increases when multiple computers are involved and it is not completely clear where each piece of evidence originated. Therefore, make every effort to maintain the context of each exhibit, noting which computer or floppy disk it came from and the associated evidence number. Also, when presenting reconstructions of events on the basis of large amounts of data such as server logs or telephone records, provide simplified visual depictions of the main entities and events rather than just presenting the complex data. It should not be necessary to fumble through pages of notes to determine the associated computer or evidence number. Also, refer to exhibit numbers during testimony rather than saying, "this e-mail" or "that print screen." Digital investigators may need to refer back to their work on a case years later and are often required to provide all notes related to their work and possi- bly different versions of an edited/corrected report. In the United Kingdom, there is a process called disclosure that aims to make the discovery process more streamlined and transparent, requiring the prosecution to provide all relevant material to the defense. 4 To facilitate such review or disclosure, it is helpful to organize any screenshots or printouts (initialed, dated, and numbered) of important items found during examination. For instance, create a neatly writ-