A Digital forensic practitioner's guide to giving evidence in a court of law
Edith Cowan University
Faculty of Computing, Health and Science
School of Computer and Information Science / Centre for Security Research
An expert in IT forensics can discover significant and damning evidence that may convict a suspect. However, no matter how momentous the evidence or how clever you may have been at recovering it, if you can’t present the evidence in a coherent and understandable way to the court the case may be lost. This paper will attempt to provide you with some translation tools and methods to assist the IT professional in giving comprehensible forensic evidence in a criminal prosecution or at Industrial Relations Commissions to jurors and the judiciary about highly complex IT concepts and recovery methodology. By using these methods, you will have an increased likelihood of your evidence being accepted and understood.