Identifying Digital Evidence
Digital evidence can be any information stored or transmitted in digital form. Because you
can’t see or touch digital data directly, it’s difficult to explain and describe. Is digital evidence
real or virtual? Does data on a disk or other storage medium physically exist, or does it
merely represent real information? U.S. courts accept digital evidence as physical evidence,
which means that digital data is treated as a tangible object, such as a weapon, paper document,
or visible injury, that’s related to a criminal or civil incident. Courts in other countries
are still updating their laws to take digital evidence into account. Some require that all digital
evidence be printed out to be presented in court. Groups such as the Scientific Working
Group on Digital Evidence (SWGDE; www.swgde.org) and the International Organization on
Computer Evidence (IOCE; www.ioce.org) set standards for recovering, preserving, and
examining digital evidence.