Digital evidence is the largest growing segment of evidence storage and management within the justice system. Management of digital evidence requires the same secure chain of custody as physical evidence, however the storage and preservation of digital evidence assets presents multiple unique challenges to evidence operations.
Sustainable evidence operations must balance the scope and scale of digital evidence management and maintain technological currency to accommodate evolving digital evidence needs. Almost all sustainable evidence operations leverage available technologies to increase operational efficiency and effectiveness.
The implementation and adoption of the Technology and Digital Evidence standards and practices recommended by the Evidence Management Institute establish a stable organizational baseline for sustainable evidence management.
This chapter covers:
Digital Evidence
A broad term for any electronically generated or stored data, metadata, file, document, audio, video or image related to a criminal investigation. The key common feature of digital evidence is data. Digital evidence may be contained or stored in a wide variety of formats from a wide variety of sources and may include devices or hardware containing data.
Asset.
Interchangeable term associated with a specific item of digital evidence.
Server Storage.
Secure data storage housed on a remote network computer.
Local Machine Storage.
Data stored on an internal or external hard drive on a single computer.
Digital Storage Media.
Refers to the specific digital recording surface used to store digital information, records or files. Common storage media types include: DVD, CD, flash-drive or hard-drive technology.
Legacy Storage Media.
Refers to digital storage media types no longer in common commercial use. Examples include: floppy disk, VHS, tape or data cassette technology.
Evidence Technology.
A broad term for devices or applications used for the forensic acquisition, processing or analysis of digital evidence assets or items.
Evidence Management Technology.
A specific term for devices or applications used for the automation of evidence management processes.
Management of digital evidence assets or items is subject to the same secure chain of custody requirements and considerations as physical evidence.
Digital evidence assets or items should be stored in a manner that preserves the integrity of the original data and provides future access to the stored data for the duration of custody.
Digital evidence assets or items should be stored and preserved with measures to guarantee or authenticate the item as a true or original copy.
Technology often evolves more rapidly than policy, procedures or practices can maintain pace. That being said, evidence management operations should be prepared to manage preservation and storage for current, legacy and emerging digital evidence sources, depending on digital evidence types in storage as evidence.
Due to the wide variety of digital media types, it is advisable to consult the media manufacturer for guidance on optimal or suitable storage preservation conditions. As a general guideline most digital media types require the following conditions for extended preservation:
Physical types of digital evidence, including storage media and device hardware containing digital evidence, should be stored under conditions that best preserve the data stored on the evidence item. It is advisable to incorporate protective packing measures into the evidence submission process and document digital evidence packaging procedures acceptable for common types of submitted evidence
Additional requirements:
One key functional difference between digital and physical evidence management is access to evidence. Digital evidence management systems may provide real-time, secure authorized access to investigators without compromising the integrity of the evidence or creating chain of custody or authenticity issues related to the item. Access to digital evidence assets or items is often critical to effective investigation practices.
Little can be predicted about the future impact or implications of digital evidence management except change and growth. Technology change and the resulting increase in data storage requirements will likely continue along an exponential trajectory. Evidence management unit personnel should develop a continual knowledge base and technical skills to plan and be ready for emerging technological developments with respect to evidence management.
Sustainable evidence management practices require accuracy, precision and detail, and completion of multiple time-consuming processes to ensure the integrity of evidence for the duration of custody. Evidence management operations are rarely staffed at levels that regularly allow manual completion of all required processes. Leveraging technology and automation resources, designed to meet the workflow and process needs within evidence management operations, increases the efficiency and effectiveness of the evidence management unit.
Multiple critical processes related to sustainable evidence management operations can be performed regularly and efficiently with appropriate automation. Few agencies have available budget resources to add staff as evidence workloads increase; fewer still have available resources to expand facilities to accommodate increased storage needs. This section details a variety of available options to consider to increase the efficiency and effectiveness of evidence operations without increasing staff levels or storage space.
Effective automation systems provide accurate real-time chain of custody documentation as evidence moves from submission through disposition. Person, location change, supporting documentation, and time and date information are consolidated into the history of each item.
Effective automation systems eliminate paper files and reliance on paper document attachments. Systems reliant on paper files are difficult to manage efficiently and present a continual risk of file loss, mislocation, and separation of critical documentation and legibility issues which may result in less reliable chain of custody data.
Effective automation systems consolidate all data and information about all cases and evidence stored in the evidence management operation. Reliance on a combination of old paper files and new electronic records, or reliance on multiple information systems and databases should be avoided. A comprehensive, or consolidated, database should be a top priority when implementing new management systems. Older evidence items are much more likely to be eligible for disposition. Failure to consolidate old data or files into an automated system only yields efficiency increases for management of new items. The resulting increase in efficiency will likely not achieve significant impacts on disposition levels.
Effective automation systems resolve multiple process efficiencies, increase accuracy and legibility through:
Effective automation systems should provide detailed system status analysis and facilitate the reporting of workload process levels, backlogs and inventory levels.
Automated evidence management processes require a balanced combination of technology solutions and established policies and procedures to meet the needs of evidence management operations. Evidence management operations should incorporate and utilize appropriate technology into workflow processes to increase efficiency and effectiveness.
Generally, evidence technology is developed by industry and adopted and utilized by forensic investigative personnel. Investigative applications of evidence technology fall outside the traditional scope of evidence management operations.
Evidence management technology refers specifically to devices or applications used in evidence management processes.
Microprocessor power, speed and wireless communications technology have evolved to the point that desktop computers are no longer essential equipment to run intensive data applications. Agencies should consider laptop, tablet, or other small form factor mobile devices for primary use in evidence management operations. Mobile devices provide access to information and real time management of evidence processes at any location or area within facility, and provide electronic transfer documentation functionality that decreases the need for additional paper form generation, completion, attachment or storage.
Generally, wireless technology hardware should be integrated into the evidence management system. Tethered devices limit device range, may prove awkward or prevent access to information and generally decrease the efficiency and effectiveness of automated processes.
