School of Computer and Information Science, Edith Cowan University, Perth, Western Australia
An expert in IT forensics can discover significant and damning evidence that may convict a suspect. However, no matter how momentous the evidence or how clever you may have been at recovering it, if you can’t present the evidence in a coherent and understandable way to the court the case may be lost. This paper will attempt to provide you with some translation tools and methods to assist the IT professional in giving comprehensible forensic evidence in a criminal prosecution or at Industrial Relations Commissions to jurors and the judiciary about highly complex IT concepts and recovery methodology. By using these methods, you will have an increased likelihood of your evidence being accepted and understood.