Please I am looking for a document listing technical artefacts used as evidence in digital forensics classified according to their evidential strength. Example IP address could be spoofed so it is a weak evidence, malware code similarity is a strong evidence etc.
Faisal A. Garba
The evidential strength of technical artifacts depends not on any classification but on the internal and external consistency among the different evidentiary factors that are present on a particular case. Each case is unique and artifacts cannot be treated in a generic fashion.
Even if the list exists I would highly question the validity of such list due to the above point and since it is a snapshot in time that quickly looses its merits based on new factors that come to light about strengths and weaknesses.
Insofar the strength of a digital evidence based on the ability to demonstrate the legal authorisation to obtain it, its authenticity, relevancy, reliability and integrity. Even when there is a reasonable doubt regarding the reliability of digital evidence, this does not necessarily make it inadmissible, but will reduce the amount of weight it is given by the court.
Case in point, United States v. Tank, although the defendant argued that the authenticity and relevance of the digital evidence was not adequately established, the prosecution used a number of witnesses to establish that the logs were authentic. Once a digital evidence is admitted, its reliability is assessed to determine its probative value. "In several cases, attorneys have argued that digital evidence was untrustworthy simply because there was a theoretical possibility that it could have been altered or fabricated. However, as judges become more familiar with digital evidence, they are requiring evidence to support claims of untrustworthiness."
notes:
i) Albert Antwi-Boasiako, Hein Venter. A Model for Digital Evidence Admissibility Assessment. 13th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2017, Orlando, FL, United States. pp.23-38, ff10.1007/978-3-319-67208-3_2ff. ffhal-01716394
ii) Digital Evidence and Computer Crime, Second Edition 7.2 Authenticity and Reliability
We keep files of all hack attempts, extracted from our log files. This includes IP address, text of hack query and timestamp.
We use this data to report the hacker to his ISP, with a view to getting the ISP to either persuade him to stop or (as usually happens) to get the account cancelled.
So far nobody has objected to the IP address, since they can check their own logs, and match the hack query in traffic from that address.
Our files are roughly segregated according to the attempted exploit, and can be used as a basis for pentesting.
- Badges
- Science topic