- Practical Mobile Forensics（Second Edition）
- Heather Mahalik Rohit Tamma Satish Bommisetty
- 353字
- 2021-07-16 10:55:48
Rules of evidence
Courtrooms rely more and more on the information inside a mobile phone as vital evidence. Prevailing evidence in court requires a good understanding of the rules of evidence. Mobile forensics is a relatively new discipline and laws dictating the validity of evidence are not widely known. However, there are five general rules of evidence that apply to digital forensics and need to be followed in order for evidence to be useful. Ignoring these rules makes evidence inadmissible, and your case could be thrown out. These five rules are: admissible, authentic, complete, reliable, and believable:
- Admissible: This is the most basic rule and a measure of evidence validity and importance. The evidence must be preserved and gathered in such a way that it can be used in court or elsewhere. Many errors can be made that could cause a judge to rule a piece of evidence as inadmissible. For example, evidence that is gathered using illegal methods is commonly ruled inadmissible.
- Authentic: The evidence must be tied to the incident in a relevant way to prove something. The forensic examiner must be accountable for the origin of the evidence.
- Complete: When evidence is presented, it must be clear and complete and should reflect the whole story. It is not enough to collect evidence that just shows one perspective of the incident. Presenting incomplete evidence is more dangerous than not providing any evidence at all as it could lead to a different judgment.
- Reliable: Evidence collected from the device must be reliable. This depends on the tools and methodology used. The techniques used and evidence collected must not cast doubt on the authenticity of the evidence. If the examiner used some techniques that cannot be reproduced, the evidence is not considered unless they were directed to do so. This would include possible destructive methods such as chip-off extraction.
- Believable: A forensic examiner must be able to explain, with clarity and conciseness, what processes they used and the way the integrity of the evidence was preserved. The evidence presented by the examiner must be clear, easy to understand, and believable by jury.
推薦閱讀
- Node Security
- RESTful Java Web Services Security
- 計算機網(wǎng)絡(luò)安全技術(shù)（第6版·慕課版）
- Kali Linux Social Engineering
- 計算機使用安全與防護
- 數(shù)據(jù)安全實踐指南
- Digital Forensics with Kali Linux
- Web安全之深度學(xué)習(xí)實戰(zhàn)
- 網(wǎng)絡(luò)安全設(shè)計、配置與管理大全
- 數(shù)據(jù)要素安全：新技術(shù)、新安全激活新質(zhì)生產(chǎn)力
- 網(wǎng)絡(luò)用戶行為的安全可信分析與控制
- 數(shù)據(jù)保護：工作負(fù)載的可恢復(fù)性
- CTF快速上手：PicoCTF真題解析（Web篇）
- Kali Linux無線網(wǎng)絡(luò)滲透測試詳解
- Blockchain Development with Hyperledger