Can Failing to Preserve Volatile Memory Evidence Ever Be in Bad Faith?

摘要

Digital evidence created and stored on computers, smartphones, and other digital devices has become increasingly important in criminal investigations and trials. Even relatively routine events can generate digital evidence. For decades, digital evidence created by computer activity and stored on hard drives was the focus of criminal investigations and civil litigation. Computer forensic experts developed tools, procedures, techniques, and practices to capture and preserve digital evidence on hard drives for later analysis. These tools and methods are employed to preserve potential digital evidence in as pristine condition as possible. Preventing any alteration to digital evidence is seen as a fundamental goal so the evidence can ultimately be used in legal proceedings.