Evidence Preservation In Procedural Investigation

Due to the volatile nature of the computer memory, information might be lost or overwritten over time. The chip in the random access memory helps the computer to run its programs more efficiently by pulling the data from the RAM. However, every time a machine is switched on, some data stored in the RAM is lost. Whereas the data stored on the hard drive is known as persistent data, the RAM is known as volatile memory. The RAM is constantly swapping the rarely used data that is the hard drive to create space for new information. Therefore, the longer the investigators wait, the more likely they will lose the incriminating data since the computer is not indefinitely persistent. It is fortunate that the investigators have found ways to preserve the evidence without necessarily switching on the computer. The contents are used in courts as the lawyers can use them as evidence for criminal activity.

As technology advances, the issues of evidence preservation are also changing.

The purpose of preserving the data is to ensure that it can be utilized in court. If the evidence is not properly handled and protected, it might be hard for it to be admitted in the legal actions against the criminals. It is at the heart of computer forensics to collect, document, preserve and interpret the computer data. The aim of performing computer forensics is to determine who was responsible for an activity in a digital environment through a procedural investigation. In preserving the digital data, the investigators use different technologies to get access to and analyze the data in the computer systems. Preservation of data also relates to how the official data is, by analysis using various techniques and aspects. This practice needs an advanced expertise that is not conversant with the regular system users and the system support

staff.

Digital evidence is stored in the form of text files, videos, images, or any other readable format in a computer. The digital evidence is important as it serves as an additional evidence against the culprit and to help in the investigation process. During investigations, examiners follow a standard procedure to ensure that there is no contamination of the evidence collected. The digital copy of the evidence is carefully conducted to ensure that the data remains in its pristine condition. The process of extracting the criminal proof is very delicate as the investigators must make sure that the integrity of data is maintained and that they cannot be questioned for contaminating the evidence.

Digital information is very fragile as it can be changed, damaged, or destroyed if it is not properly handled during the assessment process. The electronic evidence needs to preserve its integrity, and the contents should not change, as the investigators should ensure that it is the same as it appeared in the gathering phase. To accomplish this, investigators must isolate the computer and other digital devices from the suspect’s premises to make sure that they are free from access by anyone unauthorized. Next, the investigators duplicate the entire machine to create a digital copy and isolate the original hard drive and have it stored in a safe place that is only accessible to higher authority with allowed authorization, to ensure the pristine condition and integrity is of high degree. The investigator should ensure that the suspect’s computer is switched off when the duplication process is ongoing, and the best way to handle it is by using write blocker that minimizes the risk of contamination. The volatile information in the random access memory (RAM) must also be handled carefully during retrieval while ensuring that it is not contaminated, therefore is an obligation that all investigations be performed on the digital copy created. Finally, the chain of custody is very crucial part of the preservation process that is not breakable at any point in time until the process of investigation is done.