Page last updated on Tuesday, April 4 2006 at 1700 UK

Best Practice Guidelines

Ensuring that computer forensics investigations yield compliant evidence

The techniques for collecting computer-based evidence and presenting it in a Court of Law are constantly the subject of review and refinement. The underlying principals are the same as those which govern any other type of evidence and they are primarily designed to ensure integrity and reproducibility.

TKM Technologies undertake computer forensics investigations in a number of different countries. Each has its own rules on the collection, handling and presentation of electronic evidence. There is much in common between different legal jurisdictions but we remain vigilant to development in the where we operate. Below are some of the guidelines from the United Kingdom; if you would like specific information for any other country, please contact us.

United Kingdom Guidelines

In the UK, the Association of Chief Police Officers (ACPO) Computer Crime Group has drawn up a good practice guide to assist in the capture and presentation of computer-based evidence. It emphasises that the most fundamental principal in ensuring admissibility is the need to capture data appropriately from the outset. Without this, any information subsequently discovered has no value as evidence.

This principal is summarised by ACPO in their guidance for UK Police Officers...

No action taken by Police or their agents should change data held on a computer or other media which may subsequently be relied upon in Court.
An audit trail or other record of all processes applied to computer based evidence should be created and preserved. An independent third party should be able to repeat those processes and achieve the same result.

Building a forensic examination on these principals is a marque of quality but it is also important to consider others areas of law which might be relevant. These will vary between investigations, but, in the UK, some common legislative considerations include...