COMPUTER FORENSICS ANDELECTRONIC EVIDENCE

摘要

When electronic documents are used as evidence, they are referred to as electronic evidence, or e-evidence.Broadly defined, e-evidence is any electronically-stored information on any type of computer device that canbe used as evidence in a legal action. A computer forensics investigation is the search for e-evidence byanalyzing electronic devices (e.g., computers, PDAs, cell phones, iPAQs, voice-mail, servers, disks, zip drives,or backup tapes) and communication media (e.g., instant messaging or chat rooms.) In 1995, a U.S. DistrictCourt stated that “the law is clear that data in computerized form is discoverable even if paper ‘hard copies’of the information have been produced.”By 2000, email had become the most common type of e-evidence. In 2003, email evidence had become soprevalent it became known as evidence-mail. According to Garry Mathiason, whose law firm defends majorcorporations in employment cases, almost every case they handle has a “smoking email” component to it(Varchaver, 2003).In legal actions where evidence-mail or other e-evidence is used, it is as powerful as a smoking gun or DNAevidence, and as hard to deny or refute.In 2002, President George W. Bush pledged that the Justice Department would “hold people accountable” formismanaging their companies through “deceit and corruption” (Gordon, 2002). With the government’s effortsto reassure the public, it is beyond question that company emails and other electronic documents will besources of evidence for all sides of a dispute (Tambo and Redgrave, 2002).