- Practical Mobile Forensics（Second Edition）
- Heather Mahalik Rohit Tamma Satish Bommisetty
- 353字
- 2021-07-16 10:55:48
Rules of evidence
Courtrooms rely more and more on the information inside a mobile phone as vital evidence. Prevailing evidence in court requires a good understanding of the rules of evidence. Mobile forensics is a relatively new discipline and laws dictating the validity of evidence are not widely known. However, there are five general rules of evidence that apply to digital forensics and need to be followed in order for evidence to be useful. Ignoring these rules makes evidence inadmissible, and your case could be thrown out. These five rules are: admissible, authentic, complete, reliable, and believable:
- Admissible: This is the most basic rule and a measure of evidence validity and importance. The evidence must be preserved and gathered in such a way that it can be used in court or elsewhere. Many errors can be made that could cause a judge to rule a piece of evidence as inadmissible. For example, evidence that is gathered using illegal methods is commonly ruled inadmissible.
- Authentic: The evidence must be tied to the incident in a relevant way to prove something. The forensic examiner must be accountable for the origin of the evidence.
- Complete: When evidence is presented, it must be clear and complete and should reflect the whole story. It is not enough to collect evidence that just shows one perspective of the incident. Presenting incomplete evidence is more dangerous than not providing any evidence at all as it could lead to a different judgment.
- Reliable: Evidence collected from the device must be reliable. This depends on the tools and methodology used. The techniques used and evidence collected must not cast doubt on the authenticity of the evidence. If the examiner used some techniques that cannot be reproduced, the evidence is not considered unless they were directed to do so. This would include possible destructive methods such as chip-off extraction.
- Believable: A forensic examiner must be able to explain, with clarity and conciseness, what processes they used and the way the integrity of the evidence was preserved. The evidence presented by the examiner must be clear, easy to understand, and believable by jury.
推薦閱讀
- RESTful Java Web Services Security
- 計算機網絡安全技術（第6版·慕課版）
- 網絡空間攻防技術原理
- Getting Started with FortiGate
- Preventing Digital Extortion
- 網絡安全技術與實訓（第4版）（微課版）
- 數據要素安全：新技術、新安全激活新質生產力
- 數據安全與流通：技術、架構與實踐
- 交換機·路由器·防火墻（第2版）
- 黑客攻擊與防范實戰從入門到精通
- Android Application Security Essentials
- 社會工程：防范釣魚欺詐（卷3）
- Hands-On Bug Hunting for Penetration Testers
- 網絡空間安全體系
- 極限黑客攻防：CTF賽題揭秘