By the beginning of the twenty-first century, more than half of criminal cases involved a computing device of some description, and the trend has continued and is likely to rise. Its use in legal cases too has grown and shows no sign of diminishing. Digital evidence is derived from the examination of a wide range of digital devices and shares similar characteristics with other forms of evidence. There are some differences that enhance evidence recovery analysis, but, as will be seen in this book, there are characteristics that also make it challenging for practitioners.
This chapter defines and describes the special properties of digital evidence and its contribution to investigations. The topics specifically covered in this chapter will:
Define digital evidence and its use
Explain the special properties of digital evidence, including its time and location metadata and file characteristics
Highlight the technical complexities of...