Consistent practices help verify your work and enhance your credibility, so you must handle all
evidence consistently. Apply the same security and accountability controls for evidence in a civil
lawsuit as in a major crime to comply with your state’s rules of evidence or with the Federal
Rules of Evidence. Also, keep in mind that evidence admitted in a criminal case might also be
used in a civil suit, and vice versa. For example, suppose someone is charged with murder and
acquitted at the criminal trial because the jury isn’t convinced beyond a reasonable doubt of the
person’s guilt. If enough evidence shows that the accused’s negligence contributed to a wrongful
death, however, the victim’s relatives can use the evidence in a civil lawsuit to recover damages.
As part of your professional growth, keep current on the latest rulings and directives on collecting,
processing, storing, and admitting digital evidence. The following sections discuss
some key concepts of digital evidence. You can find additional information at the U.S.
Department of Justice Web site (www.usdoj.gov) and by searching the Internet for “digital
evidence,” “best evidence rule,” “hearsay,” and other relevant keywords. Consult with your
prosecuting attorney, Crown attorney, corporate general counsel, or the attorney who
retained you to learn more about managing evidence for your investigation.
In Chapter 2, you learned how to make an image of a disk as part of gathering digital evidence.
The data you discover from a forensic examination falls under your state’s rules of
evidence or the Federal Rules of Evidence. However, digital evidence is unlike other physical
evidence because it can be changed more easily. The only way to detect these changes is to
compare the original data with a duplicate. Furthermore, distinguishing a duplicate from the
original electronically is impossible, so digital evidence requires special legal consideration.
Most courts have interpreted computer records as hearsay evidence. The rule against hearsay
evidence is deceptively simple and full of exceptions. Hearsay is any out-of-court statement
presented in court to prove the truth of an assertion. In other words, hearsay is evidence of
a statement made other than by a witness while testifying at the hearing and is offered to
prove the truth of a statement. The definition of hearsay isn’t difficult to understand, but it
can become confusing when considering all the exceptions to the general rule against
hearsay.
Twenty-four exceptions