Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

Share this Page URL

Preface > Intended Audience - Pg. xix

Preface There is a tremendous knowledge gap in our legal system today when it comes to matters involving digital evidence. In our years of experience in working with attor- neys as digital forensics experts, common questions arise again and again: What do I ask for? Is the evidence relevant? What does this item in the forensic report mean? What should I ask the other expert? What should I ask you? Can you explain that to a jury? While computers and digital devices work on the binary system of simple on or off or yes or no, digital evidence cannot be interpreted in such a simplistic manner. One of the greatest mistakes that can be made is to look at any digital evidence in isolation without properly considering all of the processes, inputs, and outputs that can impact the interpretation. If the only answer to a piece of digital evidence were, "It's there or it isn't," there would be little need for experts in the field to do any more than act as data recovery technicians. No bit of digital evidence is truly isolated in such an absolute fashion; it requires that the evidence be interpreted in light of all of the processes, inputs, and quirks of the various computer operating systems and software, as well as the interaction of people with the machines. In many cases, this knowledge gap has put attorneys in the position of not knowing that digital evidence could make a difference in their cases, or has even