The nature of the transgression to some extent dictates the type of relevant evidence that may be recovered. For example, in a homicide where the victim died of gunshot wounds, it would be helpful to determine the time, location, and cause of death. A search would commence for the weapon; discharged bullets or shot, spent cartridges; gunpowder residue; blood spatter; and projectile trajectory data. At a microscopic level, DNA analysis of samples from the spent cartridge, chemical analysis of the gunpowder residue, postmortem analysis to determine the cause of death, and so forth will be undertaken.
Locard's exchange principle, described in Chapter 1, The Role of Digital Forensics and Its Environment, is as relevant in a digital forensic examination as it is in the previous scenario. In a digital environment, we are also looking for the "smoking gun," which may take the form of a death threat sent to the victim by e-mail message. The e-mail itself has to be...