Digital Forensics in Criminal Justice

There are several recovery techniques digital forensic practitioners can use when they encounter broken or damaged devices with deleted files (Daniel, 2011). File carving involves searching for specific patterns of data that match known file formats within the raw data from the disk. Even if the file system information is missing, file carving can effectively recover files. Or, data imaging can capture an exact copy of the digital media. This process saves every detail, including unallocated space, where remnants of files may reside. There are also specialized software tools like Encase or FTK that are designed to recover deleted files. They function by examining the file system on a disk and identifying files marked as deleted but still existent.

Locard's exchange principle is fundamental to forensic science, stating that every contact leaves a trace (Mistek et al., 2018). In digital forensics, this signifies that any interaction with a digital device or network invariably leaves a trace of data or a "mark." Such a mark could take the form of an IP address logged during a web session, a file left on a hard drive, metadata within a document, or even a timestamp on an email. These digital traces serve as invaluable evidence in tracing an individual's activities on their device or the internet and can provide critical evidence in criminal investigations.

Avoiding inadvertent modification of the evidence during forensic examination is of paramount importance (Hassan, 2019). The use of write blockers is a common practice that enables reading a drive without the risk of writing data back to it, thereby preventing accidental changes to the original evidence. Working on duplicates of the original evidence also ensures the preservation...

Plus, maintaining a clear chain of custody, documenting all individuals who have had physical or digital possession of the evidence, is important for accountability and traceability.

Specific devices, like laptops, smartphones, and IoT devices, each...

…the service provider, not the user. However, investigators can make a formal request to the service provider to preserve the user's data, possibly accompanied by a legal order. Many service providers have legal processes in place to deal with such requests. Investigators can also capture cloud data by logging into the account (with appropriate legal authority) and downloading the data (Hassan, 2019).

Investigators do need legal authorization to access data, whether it is stored on a local device or in the cloud (Daniel, 2011). This is due to privacy laws that protect individuals' rights to their data. Without proper legal authorization, any evidence obtained could be considered inadmissible in court. This typically involves obtaining a search warrant or court order. In the context of cloud data, the legal process can be more complicated because the data may be stored in a different jurisdiction or even a different country. Mutual legal assistance treaties (MLATs) or other legal instruments may be required to obtain the data legally. The specifics of these…