Forensic Guide

adrickU.S. Department of Justice Office of Justice Programs National Institute of Justice

APR. 04

Special

REPORT

Forensic Examination of Digital Evidence: A Guide for Law Enforcement

U.S. Department of Justice Office of Justice Programs 810 Seventh Street N.W. Washington, DC 20531

John Ashcroft Attorney General Deborah J. Daniels Assistant Attorney General Sarah V. HartDirector, National Institute of Justice

This and other publications and products of the U.S. Department of Justice, Office of Justice Programs, National Institute of Justice can be found on the World Wide Web at the following site: Office of Justice Programs National Institute of Justice http://www.ojp.usdoj.gov/nij

APR. 04

Forensic Examination of Digital Evidence: A Guide for Law EnforcementNCJ 199408

Sarah V. Hart Director

This document is not intended to create, does not create, and may not be relied upon to create any rights, substantive or procedural, enforceable at law by any party in any matter civil or criminal. Opinions or points of view expressed in this document represent a consensus of the authors and do not represent the official position or policies of the U.S.Department of Justice. The products, manufacturers, and organizations discussed in this document are presented for informational purposes only and do not constitute product approval or endorsement by the U.S. Department of Justice. This document was prepared under Interagency Agreement #1999–IJ–R–094 between the National Institute of Justice and the National Institute of Standards and Technology,Office of Law Enforcement Standards. The National Institute of Justice is a component of the Office of Justice Programs, which also includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime.

Foreword
Developments in the world have shown how simple it is to acquire all sorts ofinformation through the use of computers. This information can be used for a variety of endeavors, and criminal activity is a major one. In an effort to fight this new crime wave, law enforcement agencies, financial institutions, and investment firms are incorporating computer forensics into their infrastructure. From network security breaches to child pornography investigations, the common bridge isthe demonstration that the particular electronic media contained the incriminating evidence. Supportive examination procedures and protocols should be in place in order to show that the electronic media contains the incriminating evidence. To assist law enforcement agencies and prosecutorial offices, a series of guides dealing with digital evidence has been selected to address the completeinvestigation process. This process expands from the crime scene through analysis and finally into the courtroom. The guides summarize information from a select group of practitioners who are knowledgeable about the subject matter. These groups are more commonly known as technical working groups. This guide is the second in a series. The first guide, Electronic Crime Scene Investigation: A Guide forFirst Responders, is available through the National Institute of Justice Web site at http://www.ojp.usdoj. gov/nij/pubs-sum/187736.htm. The remaining guides in the series will address—
■ ■ ■ ■

Investigating high technology crimes. Creating a digital evidence forensic unit. Presenting digital evidence in the courtroom.

Because of the complex issues associated with digital evidence examination,the Technical Working Group for the Examination of Digital Evidence (TWGEDE) recognized that its recommendations may not be feasible in all circumstances. The guide’s recommendations are not legal mandates or policy directives, nor do they represent the only correct courses of action. Rather, the recommendations represent a consensus of the diverse views and experiences of the technical working...