EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 1 : Computer Forensics in Today's World
         
Notes available : 31 You are not logged in.
Please Login for track your learning progress
   
 
Sl.No: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
Go to Note No.



Bookmark this Note
Note ID: 133

Rules of Evidence


If you want to share the link of this note, please click here to "Copy note link" and share that generated link. Link from URL may change in future.
 


The submission of evidence in a legal proceeding, particularly in cybercrime cases, can pose major challenges. Specific knowledge is required to collect, preserve, and transport the evidence because the evidence obtained from a cybercrime case might differ from traditional forms of evidence. Often, evidence associated with cybercrimes is in the digital form.

Before the legal proceeding, the evidence to be presented in court must comply with five basic rules of evidence.

1. Understandable: Investigators and prosecutors must present the evidence in a clear and comprehensible manner to the members of the jury. They must explain the facts clearly and obtain expert opinion to confirm the investigation process.

2. Admissible: Investigators need to present evidence in an admissible manner, which means that it should be relevant to the case, act in support of the client presenting it, and be well-communicated and non-prejudiced

3. Authentic: Given that digital evidence can be easily manipulated, its ownership needs to be clarified. Therefore, investigators must provide supporting documents regarding the authenticity of the evidence with details such as the source of the evidence and its relevance to the case. If necessary, they must also furnish details such as the author of the evidence or path of transmission.

4. Reliable: Forensic investigators should extract and handle the evidence while maintaining a record of the tasks performed during the process to prove that the evidence is dependable. Forensic investigations must be conducted only on copies of the evidence because working on the original evidence may manipulate it and make it inadmissible in the court.

5. Complete: The evidence must be complete, which means that it must either prove or disprove the consensual fact in the litigation. If the evidence fails to do so, the court is liable to dismiss the case, citing a lack of integral evidence.



  Go to notes  






WELCOME TO ONLINE EXAM PREPARATION SYSTEM

Certification Examinations