To reduce the chance of being compromised, digital evidence must be preserved in a secure way when it is generated. The preservation must assure confidentiality, integrity, and survivability of the digital evidence. Some generic storage systems have been proposed. However, they cannot meet the critical requirements for digital evidence preservation. This paper introduces a secure distributed di...

In this paper, we define, model, and show the uses of evidence in an investigation, specifically a digital investigation. Digital evidence has been used in the courts to help prove cases, but its characteristics and role in an investigation have not been formally defined or challenged. This paper defines digital evidence by observing the role of evidence in a physical investigation, modeling th...

With the advent of Information and Communication Technologies, the means of committing a crime and the crime itself are constantly evolved. In addition, the boundaries between traditional crime and cybercrime are vague: a crime may not have a defined traditional or digital form since digital and physical evidence may coexist in a crime scene. Furthermore, various items found in a crime scene ma...

Digital forensic standards have been developed that apply to the collection and preservation of digital evidence and they differ depending on the scene, nature and type of evidence being handled. For the successful prosecution and admissibility in court, certain accepted procedures have to be properly followed. Digital forensic examiners use different methods and tools to accomplish the same jo...

Recent legal cases have shown that digital evidence is becoming more widely used in court proceedings (by defense, accusation, public prosecutor, etc.). Digital tracks can be left on computers, phones, digital cameras as well as third party servers belonging to Internet Service Providers (ISPs), telephone providers and companies that provide services via Internet such as YouTube, Facebook, Gmai...