Australian Digital Forensics Conference

Document Type

Conference Proceeding


School of Computer and Information Science, Edith Cowan University, Perth, Western Australia


An expert in IT forensics can discover significant and damning evidence that may convict a suspect. However, no matter how momentous the evidence or how clever you may have been at recovering it, if you can’t present the evidence in a coherent and understandable way to the court the case may be lost. This paper will attempt to provide you with some translation tools and methods to assist the IT professional in giving comprehensible forensic evidence in a criminal prosecution or at Industrial Relations Commissions to jurors and the judiciary about highly complex IT concepts and recovery methodology. By using these methods, you will have an increased likelihood of your evidence being accepted and understood.


Originally published in the Proceedings of the 4th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia, December 4th 2006.