Problem 1: Digital evidence refers to digital data that is able to establish a crime has been committed, can provide a link between a crime and its victim, or can provide a link between a crime and the perpetrator.
Source: Carrier & Spafford, 2003, "Getting physical with the digital investigation process"
Describe further based on the above definition:
- How does collecting digital evidence differ from normal evidence?
- What are the challenges?
Problem 2: Elaborate further (include a supporting example too) based on EACH of the following 4 principles of cyber forensics:
(i) The act of collecting digital evidence should not result in any alteration of the data in question, wherever this is possible
(ii) All handling of digital evidence from collection through to preservation and analysis must be fully documented
(iii) Access to original digital evidence should be restricted to those deemed "forensically competent"
(iv) Your actions taken should not affect the integrity of the evidence
Source: https://www.forensicfocus.com/principles-of-computer-forensics