Digital Evidence: Before the Investigators Get There

This Whitecaps post could be sub-titled "What to do before the investigators arrive." It illustrates the need for private industry to be able to recognize and preserve digital media that may contain evidence of criminal or civil misconduct.

On Friday, February 2, 2007, The Spokesman Review staff writer John Craig wrote an article headlined "S-R worker may have downloaded child porn". The subhed was, "Web employee fired after images found on two company computers". Craig's article briefly describes how the newspaper's staff discovered and then preserved the evidentiary value and admissibility of the digital evidence. A more complete discussion of the newspaper's procedures is available in the paper's "The Transparent Newsroom" blog under the headline Mud bath anyone?. Scroll down in that piece to the hyperlink "the video" and watch it. Make sure your sound is on.

The newspaper's experience shows that private sector businesses would benefit from talking with their attorney about their duties and responsibilities to preserve digital material. They should have a simple but effective process in place that prepares key employees (including all supervisors) to recognize obvious evidence and preserve it properly when necessary. In most instances, doing little is far better than trying to do too much. It is not the employee's responsibility to become crime scene investigators. It should be their responsibility to preserve, not process, digital evidence. The staff at The Spokesman-Review did it correctly.

In preparing employees to recognize and preserve digital evidence, employer training officers may wish to consult the guides prepared by the National Institute of Justice. These guides are intended for investigators and prosecutors, but the material would help a corporate training officer better understand what the company's employees should do and what they must never be expected to do. Here are links to the four existing guides:

• Electronic Crime Scene Investigation: A Guide for First Responders
• Forensic Examination of Digital Evidence: A Guide for Law Enforcement
• Investigations Involving the Internet and Computer Networks
• Digital Evidence in the Courtroom - A Guide for Law Enforcement and Prosecutors
  
  Two more guides are being prepared and will address using advanced technology to investigate and creating a digital evidence forensic unit.