This module is a resource for lecturers  

 

Introduction

 

Forensic science applies "natural, physical, and social sciences to matters of law" (Maras and Miranda, 2014, p. 1). One of the many branches of forensic science is digital forensic science (or as it is more commonly known, digital forensics). Digital forensics is a "branch of forensic science that focuses on criminal procedure law and evidence as applied to computers and related devices" (Maras, 2014, p. 29), such as mobile devices (e.g., phones and smartphones), gaming consoles, and other Internet-enabled devices (e.g., health, fitness, and medical devices). Particularly, digital forensics refers to the process of collection, acquisition, preservation, analysis, and presentation of electronic evidence (a.k.a., digital evidence) for intelligence purposes and/or use in investigations and prosecutions of various forms of crime, including cybercrime.

Note

While this Module focuses on digital forensics in law enforcement investigations and prosecutions of cybercrime, many digital forensics activities are conducted by those outside of the criminal justice system, such as private companies and organizations (for information about digital forensics activities of private companies and organizations, see Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics). In fact, many different agencies, organizations, businesses, and individuals can engage in digital forensics and cybercrime investigations (see Module 5 on Cybercrime Investigation for information about those involved in these investigations).

This Module provides an overview of digital forensics and digital evidence, looking in particular at the digital forensics process, common digital forensics practices, standards for digital forensics and digital evidence, and good practices in digital forensics.

 

Learning Outcomes

  • Discuss data and identify data sources
  • Describe and discuss digital evidence
  • Compare and contrast the differences between digital evidence and traditional evidence
  • Discuss the ways in which digital evidence is authenticated
  • Describe and critique digital forensics process models
  • Critically evaluate standards and good practices for digital evidence and digital forensics
 
Next: Key issues
Back to top