Preservation of evidence

Preservation of biological evidence can profoundly impact criminal justice as it can be essential to establish the innocence of a convicted person and thus make evident a miscarriage of justice. The paper provides information and insights regarding the State’s duty to preserve biological evidence in criminal justice, thus improving accessibility issues in the post-conviction review in Chile. In doing so, the paper looks beyond Chile’s borders and seeks to obtain lessons from the U.S. States’ preservation statutes. The research uses law comparison to assess and comprehend the appropriateness of Chilean regulation and then to identify areas for improvement in the criminal justice system.

Digital Forensic is the preservation, identification, recovery, documentation, analysis, and interpretation of digital evidence. Digital evidences are electronically stored records, facts, signs, information of probative value that shows clearly that an event occurred or that a crime has been committed. Preservation of Digital Evidence is the crux of Digital Forensics. As such, it must be handled in a way to ensure that it is promptly identified, preserved, collected, examined, analyzed and documented appropriately so that it is evidently weighty, authentic, reliable, believable, complete and that it passes the test of legal admissibility. Evidence Preservation is being constantly plagued with issues needed to be technically, administratively and legally resolved. Of which is, the rate of standardization of Digital Forensics Processes, particularly evidence preservation, by International standardizing bodies is slower than the challenges and continuously evolving digital technology. Consequently, Proactive, Sustained and Non-fragmented Research and Practitioner Communities must be established, where they do not exist and also supported by national and regional standardization organizations, to see to faster and up-to-date solutions. Such communities have greatly helped to sustain continuous growth and standardization in other fields such as software engineering, web frameworks, and mobile technology. A consolidated framework, the Enhanced Generic Digital Forensic Investigation Model (EGDFIM), is proposed in this work.

Abstract—Digital Forensics can be defined as a field of study involving the usage of technical and proved procedures for collecting, preserving, validating, analyzing, interpreting and presenting the Evidences extracted from the digital sources for presenting those in the court of law. Different process models have been proposed by the researchers for cyber crimes’ investigation process, each having its own suitability to environments where they are applicable and other pros and cons. The paper includes the tailoring of existing process models to the particular domain of higher education institutes. With the growing access of computing resources and internet to the students, employees and overall citizens, it is the need of time that organizations should establish and maintain their cyber forensics analysis policy along with whole process to be followed in case of any cyber crime scene reporting. Index Terms—Cyber forensics investigation, Cyber forensics investigation process models...

Preservation of biological evidence can profoundly impact criminal justice as it can be essential to establish the innocence of a convicted person and thus make evident a miscarriage of justice. The paper provides information and insights regarding the state’s duty to preserve biological evidence in criminal justice, thus improving accessibility issues in the post-conviction review in Chile. In doing so, the paper looks beyond Chile’s borders and seeks to obtain lessons from US states’ preservation statutes. The research uses law comparison to assess and comprehend the appropriateness of Chilean regulation and then to identify areas for improvement in the criminal justice system.

The nature of information in a network is volatile and dynamic, some precious evidence might be missed. The real-world situations need a quick classification decision before the flow finishes, especially for security and network forensic purposes. Therefore, monitoring network traffic requires a real-time and continuous analysis, to collect valuable evidence such as instant evidences that might be missed with post-mortem analysis (dead forensics). Network traffic classification is considered the first line of defence where a malicious activity can be filtered, identified and detected. In addition, it is the core component in evidence collection and analysis that uses filtered evidence and helps to reduce redundancy. However, most of the existing approaches that deal with collecting evidence from networks are based on post- mortem analysis. Therefore, this research investigates different classification techniques using Machine Learning (ML) algorithms, seeking to identify ways to imp...

The nature of information in a network is volatile and dynamic, some precious evidence might be missed. The real-world situations need a quick classification decision before the flow finishes, especially for security and network forensic purposes. Therefore, monitoring network traffic requires a real-time and continuous analysis, to collect valuable evidence such as instant evidences that might be missed with post-mortem analysis (dead forensics). Network traffic classification is considered the first line of defence where a malicious activity can be filtered, identified and detected. In addition, it is the core component in evidence collection and analysis that uses filtered evidence and helps to reduce redundancy. However, most of the existing approaches that deal with collecting evidence from networks are based on post- mortem analysis. Therefore, this research investigates different classification techniques using Machine Learning (ML) algorithms, seeking to identify ways to imp...

As  megacities  emerge  in  splendor, so  also do  threats  to  security  and sustainability of these cities. Earlier research found out that the leading threat amongst several security and safety threats in megacities are organized crimes. Since technology is involved in all facets of megacities, including the threats therein, this paper seeks to stimulate scientific curiosity in finding out effective and sustainable ways of harnessing technology  in  readiness,  to  protect  these  cities  from  threats  rather  than  reactively responding to them.

A  Megacity  Digital  Forensic  Readiness  Model  (MEDFORM)  is proposed in this presentation.

Digital Forensic is the preservation, identification, recovery, documentation, analysis, and interpretation of digital evidence.
Digital evidences are electronically stored records, facts, signs, information of probative value that shows clearly that an event occurred or that a crime has been committed.
Preservation of Digital Evidence is the crux of Digital Forensics. As such, it must be handled in a way to ensure that it is promptly identified, preserved, collected, examined, analyzed and documented appropriately so that it is evidently weighty, authentic, reliable, believable, complete and that it passes the test of legal admissibility.
Evidence Preservation is being constantly plagued with issues needed to be technically, administratively and legally resolved. Of which is, the rate of standardization of Digital Forensics Processes, particularly evidence preservation, by International standardizing bodies is slower than the challenges and continuously evolving digital technology. Consequently, Proactive, Sustained and Non-fragmented Research and Practitioner Communities must be established, where they do not exist and also supported by national and regional standardization organizations, to see to faster and up-to-date solutions. Such communities have greatly helped to sustain continuous growth and standardization in other fields such as software engineering, web frameworks, and mobile technology.
A consolidated framework, the Enhanced Generic Digital Forensic Investigation Model (EGDFIM), is proposed in this work.

To understand an incident crime case and achieve the consistent electronic evidence, the investigator needs to deal with an investigation tutorial. In this paper, we study and compare some of mainly accepted digital investigation models. Then we check the investigation model accuracy by testing the main rules availability. A new model is developed which merges the former models and seeks to meet some contraints. This can help investigators to achieve electronic evidence in illegal manner and in understandable format to be presented to the court.
Keywords — digital investigation model, digital evidence, forensic computer, electronic evidence, electronic crime.

The  recent  rise  in  disputes  relating  to
electromagnetic computer records has prompted the
demand for digital forensic tools that can be used to
preserve,  investigate,  and  analyze  digital  evidence.
Among  the  currently  available  digital  forensic
publications  are  the  Guidelines  for  Preservation  of
Evidence  published  by  the  Institute  of  Digital
Forensics,  a  non-profit  organization.  However,  in
the field of digital evidence preservation, speed and
accuracy are fundamental requirements. Under such
circumstances,  working  with  guidelines  in  paper
media form is difficult for investigators. Therefore,
we  have  developed  an  application  program  that
supports  evidence  preservation  work  by  displaying
contents based on the Guidelines for Preservation of
Evidence  on  the  Android  operating  system.  The
system consists of three components: the first is the
creation  of  contents  for  display  on  an  Android
terminal from the paper guidelines, the second is a
guideline execution section for first responders, and
third is a function that allows the system to generate
an output report based on the first two components.
In this paper, the authors report on improvements to
the  first  and  second  components,  and  the
development  of  the  third.  Additionally,  after
applying  the  complete  system  to  a  small  trial
scenario based on an actual incident, an evaluation
of  the  utility  and  effectiveness  of  the  system  was
conducted.