Advantages And Disadvantages Of Forensic Tools

The advantages of using forensic tools during a computer investigation include the ability to quickly search through vast amounts of data, to be able to search in several languages (especially important since the internet doesn’t have boundaries), and that data that was once considered deleted can now be retrieved with the forensic tools.

There are also several disadvantages in that the use of computer forensic tools can also modify existing data, therefore, the forensic specialist must document everything that was done, what software, and what was changed. Poor documentation could result in the evidence not being admissible. Also, there can be steep costs associated with hiring a forensic specialist to analyze all the data. In addition,

The Fourth and Fifth Amendments protect an individual’s right to privacy and self-incrimination. For example, when a search warrant is issued to seize computer and digital evidence, data that is discovered that is unrelated to the investigation, that could encroach on that individual’s privacy will be excluded from the investigation. The chain of custody is to protect the investigators or law enforcement. The purpose is to document everything, including the data, time, what was seized, how was it seized, and who seized it, who accessed the digital or computer data, etc. This will help prevent any accusations of planted evidence or intentional tampering by the prosecution, or having the evidence thrown out for poor chain of custody (or chain of evidence). Finally, the third important evidence law is the amendment to the US Rules of Evidence 902, effective 12/01/2017, which states that electronic data that is recovered using a digital identification must be self-authenticating. Meaning, most data or electronic files are already authenticated by a hash value, which is an algorithm based on the hard drive, thumb drive, or other medium. What this means is if the original and the copy have identical hash value, then it is probably or likely they are identical or exact duplicates. Ultimately, this means that properly certified data will be presumed to be authentic, and must be done by a qualified person who is trained and in the practice of collecting, preserving, and verifying the information. The question is who does this benefit most? Both sides depending on how you look at it. A defendant can challenge the evidence as hearsay or even on its admissibility. But, a prosecution could use it in their favor stating a qualified computer forensic investigator was able to collect, preserve, and verify the