WHEN IS DIGITAL EVIDENCE FORENSICALLY SOUND?

摘要

"Forensically sound" is a term used extensively in the digital forensics community to qualify and, in some cases, to justify the use of a particular forensic technology or methodology. Indeed, many practitioners use the term when describing the capabilities of a particular piece of software or when describing a particular forensic analysis approach. Such a wide application of the term can only lead to confusion. This paper examines the various definitions of forensic computing (also called digital forensics) and identifies the common role that admissibility and evidentiary weight play. Using this common theme, the paper explores how the term "forensically sound" has been used and examines the drivers for using such a term. Finally, a definition of "forensically sound" is proposed and four criteria are provided for determining whether or not a digital forensic process may be considered to be "forensically sound."