- Since most digital evidence are always ruled inadmissible especially if they are obtained without authorization, it would be therefore prudent to seek for authorization before taking and working on the evidence. A search is generally illegal and unreasonable without a warrant; this is subject only to a few exceptions. Before commencing with the search, it is important to note that the law officer must demonstrate and display a probable cause that the search is justified. A probable cause is necessary before commencing with the search. In this case I believe that Mr. Got has hidden information that is of great controversy and that is subject to criminal offence. Before I seize the property, I will seek the authority of a magistrate who will consider the totality of the circumstances before and later on determine whether it is justified to issue a search warrant. For the magistrate to issue the warrant, I will have to document my request so as to prove that Mr. Got is taking with him Make stuff’s intellectual property with him to his new employer. An action that is liable to stealing and invasion of privacy. The recorded interview with Mr. Andifrum is primary evidence that can be used to seek for the authorization.
- Three potential items of digital evidence that can be found in the photo are; Computer, Western Digital hard disk and Thumb drive, and USB, PNY-brand, 64GB in size. The computer is a device that can hold information ranging from emails, digital photographs, word processing documents, ATM transaction logs, files that have been saved for accounting programs, internet browser histories, computer backups, contents of computer memory, GPS tracks, computer printouts, logs from office electronic door locks, audio files and digital video. In order to prevent any alteration of the digital evidence collected, during the collection process I will first document information, that I have collected by first taking photographs and recording the information displayed in the screen. I would also move the mouse without pressing any button or moving the mouse wheel so as to identify or find out if anything is moving on the screen. If the computer is on I would seek the help of a computer forensic expert so as to ensure that any connections to criminal activity are not lost when I switch it off. In case the computer is on but it is running destructive software; software that is deleting, wiping out information or formatting the data stored, I will first disconnect the power immediately so as to preserve anything left in the machine (Casey, 2011). USB, PNY-brand, 64GB in size is a backup data device that can also be used to store video files, audio files, database login details, spreadsheets and files. In order to prevent any alteration, my first step would be to unplug it from the computer or laptop incase it is connected; If it is disconnected I will put it in an antistatic paper bag for further analysis. The computer hard disk is also an example of a back up data that can be used to store information. In the hard disk, audio files, video files and database can be found. Such information is quite important for primary and secondary investigations. The best way to collect such digital evidence is to put it in an antistatic paper bag for further analysis.
- Other forms of non digital evidence that can be found in the photograph include; yellow stickers attached on the wall, a white notebook, and files in the brown envelope. The yellow stickers attached on the wall and other equipments contain reminder notes that can be used as a link to the general source of information. The best way to collect such information is by detaching them carefully so that they do not tear off. The white notebook contains scribbled notes that either act as a map to the source of information or a map to link to the general information. Such information can be recorded or photographed before sealing it for further analysis. The files in the envelope act as the source of vital information and they are very important during the investigation. Such information should be handled carefully to avoid tearing off or alteration. The best way to collect them is to photograph every document and seal the information.
- I believe my coworker has not described the items adequately. In his description, the coworker should identify the functions and the capacity of the items. My coworker should indicate for example; voice recorder small silver Olympus capable of recording audio sound and high pitched sounds of up to 20 gigabytes. Item no 2 and 3 have however been adequately described.
- The digital evidence collected from the scene should follow normal evidence collection procedures such as sealing the documents in a transparent polythene and antistatic bag for digital devices to prevent exposure to things such as extreme moisture, temperatures and static electricity. Digital devices should be placed in antistatic packaging e.g. paper bags cardboard boxes and envelopes (Casey, 2011). Plastic paper bags should not be used since they can convey static electricity and allow for humidity and condensation. The non digital evidence described above should be stored in a dry place and away from light to prevent bleaching of the document and ink written information.
Casey, E. (2011). Digital evidence and computer crime: forensic science, computers and the internet. Academic press.