What makes data evidence

Every investigation that touches a computer, a phone or an online account ends with the same question: can this data be trusted to show what happened? A file on a laptop is just data. It becomes digital evidence when it is relevant to a question someone has to decide, and when it was handled in a way that lets others rely on it. This lesson explains that difference, what makes digital evidence unlike paper or physical traces, and the principles that international standards use to judge it.

Data, information and evidence

It helps to separate three ideas that are often used as if they were the same.

• Data is what is stored: bytes in a file, a database record, a log line, the contents of memory.
• Information is data read in context. A row in a browser history database is data; "this account visited this web page at 14:02 UTC" is information.
• Evidence is information that helps prove or disprove a fact in question, and that was identified, collected and preserved so that its origin and integrity can be shown.

ISO/IEC 27037, the international guideline for identifying, collecting, acquiring and preserving digital evidence, defines digital evidence as information or data, stored or transmitted in binary form, that may be relied on as evidence. Until it has been examined, the standard calls it potential digital evidence: nobody knows yet whether it matters, so it must be handled as if it might.

What sets digital evidence apart

Digital evidence follows the same logic as any other evidence, but it behaves differently in ways that shape every step of the work.

• It is latent. Nobody can read a disk by looking at it. Tools and an examiner are needed to make the data visible, so the method itself must be explained and trusted.
• It is fragile. Data can be changed, overwritten or destroyed by ordinary use of the device, by an automatic update or by a careless examiner. Lesson 1.2 covers this in detail.
• An exact copy is possible. Unlike a fingerprint lifted from a glass, a bit-for-bit copy of a drive is identical to the original. A cryptographic hash value, such as SHA-256, lets anyone check that the copy has not changed (Module 4).
• It carries metadata. Files, messages and records come with data about themselves: timestamps, authors, device identifiers, locations. Metadata often answers the question better than the content does.
• It is abundant and mixed. A single phone holds years of a person's life, and data belonging to other people. Examiners must find what is relevant without wandering beyond what they are authorized to examine (Module 2).
• It is often somewhere else. Email, chats and documents may sit on servers in other countries, synchronized across several devices.

Three tests: relevance, reliability and sufficiency

ISO/IEC 27037 names three principles that govern digital evidence. They are a useful checklist for any item you consider collecting.

Sufficiency does not mean collecting everything. It means collecting enough to answer the question and to test other explanations, while staying within the scope of the authorization.

Four aspects of sound handling

The same standard lists four aspects that make the handling of digital evidence defensible. They come up again in every module of this course.

1. Auditability: an independent person can review what was done, because every action was recorded.
2. Repeatability: the same examiner, using the same method and tools in the same conditions, gets the same result.
3. Reproducibility: another examiner, with different tools or in a different laboratory, using the same method, gets the same result.
4. Justifiability: every action and decision can be explained as the best available choice in the circumstances.

Repeatability and reproducibility are why examiners work on verified copies and avoid tools whose results cannot be checked. Justifiability matters when the ideal step was impossible: if a phone had to be examined while switched on, the notes should say why.

Evidence for both sides

Evidence that supports an allegation is called inculpatory; evidence that weakens it is exculpatory. An examiner looks for both. A log that shows an account copying files is inculpatory; the same log showing that the account was in use while its owner was on a flight is exculpatory, and it must be reported just as clearly. Forensic examination serves the finding of facts, not one party.

Common misconceptions

Four beliefs cause most early mistakes with digital evidence.

• "Deleted means gone." Deleting a file usually removes only the reference to it; the content often stays until it is overwritten. The reverse is also true: some systems, such as solid-state drives, erase deleted data quickly (Lesson 1.2).
• "A screenshot is enough." A screenshot shows what a screen displayed, not where the data came from. It is a useful pointer, not a substitute for the source.
• "The tool is always right." Forensic tools parse data according to what their developers understood. Results must be checked, especially for new versions of operating systems and apps.
• "More data is always better." Collecting everything can exceed the authorization, intrude on other people's privacy and bury the relevant items. Collect what the questions require and what is needed to test alternatives.

A worked example

A company suspects that an employee sent a confidential price list to a competitor before resigning. The first file that surfaces is a screenshot of an email forwarded by a colleague.

• The screenshot is relevant, but weak on reliability: it can be edited, and it shows no header data proving who sent the message, when and to whom.
• The mailbox on the company's mail server, exported with its headers and verified by hash values, is far more reliable.
• For sufficiency, the examiner also preserves the sent-items folder, the mail server's transport logs and the employee's laptop, so that other explanations, such as a delegated account or a shared password, can be tested.

The same fact, "this email was sent", is weak or strong evidence depending on where it came from and how it was handled.

Exam focus: Know the difference between data, information and digital evidence; the three principles of ISO/IEC 27037 (relevance, reliability, sufficiency) and its four handling aspects (auditability, repeatability, reproducibility, justifiability), and tell repeatability from reproducibility. Expect questions on what makes digital evidence different: latent, fragile, exactly copyable and verifiable by hash values, rich in metadata. Remember that examiners look for exculpatory as well as inculpatory evidence.