12: Digital Forensics

Digital technology has rapidly moved from a domain for specialists and those with office jobs to an essential part of everyone's lives, no matter what age, occupation or walk of life. Nearly everyone communicates regularly with others using digital technology and regularly carries a computer with them in the form of a smartphone. This means that digital forensics is now likely to play a part in just about every crime investigation, and all investigators need to have a basic grasp of its capabilities and limitations. In this chapter we begin by looking at the laws and guidelines that govern digital forensics investigations, including the risks an investigator may face in examining data. We look at the techniques needed to legally acquire data from a variety of sources and some of the problems presented by recent changes in the capabilities of digital technologies, and the ways in which they are being used. Next we look at a number of techniques for analysing digital artefacts and the kinds of evidence that may be discovered. We conclude with some guidelines for reporting results of a digital forensics investigation as well as some of the coming challenges for the digital forensics investigator.