Finding Deleted Evidence Three Facts about Digital Forensics

Forensic computer examiner

Did you know that 91% of adults in the U.S. own a cell phone? Our phones are one of the main ways we communicate with each other on a daily basis. Many handle everything from texting, to emailing, to scheduling and more. What happens, though, when you need to retrieve information from your phone or computer that has otherwise been deleted? What sort of backing will you need if it becomes important in a court of law? Here are three things to keep in mind.

1. What Does a Computer Forensics Specialist do for You?

Computer forensic experts can find files and data you might have assumed were otherwise long gone. This can be important for establishing everything from alibis to a presence or lack of motive during a criminal investigation. The BTK murder, who bound, tortured and killed (BTK) ten people in Kansas and taunted police for years, was finally caught in 2005 thanks to computer forensics. Dennis Radar made the mistake of sending police a taunt via floppy disk. The police were able to recover deleted data indicating his name and the church he went to. A computer specialist can do anything from analyzing metadata for clues, to re-creating deleted files or emails.

2. What are Digital Image Forensics?

Digital image forensics are the process of examining digital images to see what they can reveal. In cases that rely on knowing if the image is real or has been doctored or otherwise fabricated, image forensics can help distinguish truth from falsehood. There are even algorithms available that can detect “cloned” areas and areas that lack the correct mathematical properties of a true, raw photograph.

3. What Counts as Admissible Digital Evidence?

It’s important to note that digital evidence is frequently ruled as inadmissible to court because it was seized without permission. In most places, it is only legal to take and search digital devices once a warrant has been issued. However, there are rules regarding “in plain view.” If the computer or device is on and the detective or police see visible evidence of a crime on the screen, then that can be used as a reason to search the PC. The reliability of digital evidence is still often in dispute- if evidence can be easily altered then who is to say someone isn’t being framed?

Are you interested in digital forensic science? Good references here.

Leave a Reply