Digital forensics is an interdisciplinary field combining computer science, forensic science and law. Its main purpose is to identify, preserve and analyse digital data in a manner that allows it to be used as evidence in judicial proceedings. As noted by Maciej Szmit, developments in information technology mean that a growing proportion of human-generated information is digital, naturally increasing the importance of digital trace analysis in legal proceedings (Szmit, 2018).
For this reason, digital forensics is used in criminal, civil and administrative proceedings, particularly in cases concerning cybercrime, information security breaches and analysis of data stored on electronic devices.
Digital forensics as a scientific discipline
In the literature, digital forensics also appears under names such as forensic computing, computer criminalistics and computer forensics. As emphasised by Szmit (2018), this field operates at the intersection of technical and social sciences, primarily computer science, law and security studies.
Forensic computing primarily encompasses the expert advisory role of computing: preparing expert reports on the operation of information systems, analysing digital data and interpreting technical examination results for judicial proceedings (Szmit, 2018).
The key research areas in this discipline include:
- analysis of computing devices,
- examination of digital storage media,
- identification and interpretation of digital traces.
Digital forensics and cybercrime
One of the most important applications of digital forensics is the analysis of computer crime. Under the Council of Europe Convention on Cybercrime, several basic categories of these offences can be distinguished, including:
- illegal access to information systems,
- illegal interception of data,
- interference with data and system integrity,
- computer-related forgery,
- computer fraud.
As noted by Szmit (2018), many of these acts are covered by the Polish Criminal Code, particularly Articles 267–269b and Article 287, which concerns computer fraud.
Crime statistics also show that the number of offences against information protection in Poland is steadily increasing, which raises the significance of digital forensic tools in the work of law enforcement authorities (Szmit, 2018).
Evidentiary standards in digital data analysis
In the American legal system, an important role is played by the so-called the Daubert standard, which sets criteria for assessing the scientific reliability of an expert opinion. As Szmit (2018) notes, this standard derives from United States Supreme Court case law and requires, among other things, testable examination methods and their acceptance within the scientific community.
This standard was shaped by decisions including:
- Daubert v. Merrell Dow Pharmaceuticals (1993),
- General Electric Co. v. Joiner (1997),
- Kumho Tire Co. v. Carmichael (1999).
Unlike the American system, Polish criminal procedure applies the principle of the court's free assessment of evidence, meaning that formal requirements for expert opinions may be less prescriptive (Szmit, 2018).
Digital forensics standards and good practices
The development of digital forensics methods is closely linked to the work of research institutions and standardisation organisations. As Szmit (2018) notes, American research institutions and international standards organisations play a particular role.
The most important standards used in digital forensics include:
- ISO/IEC 27037—identification and preservation of digital evidence,
- ISO/IEC 27041—methods for incident investigations,
- ISO/IEC 27042—analysis and interpretation of digital evidence,
- ISO/IEC 27043—principles of digital investigations.
The work of organisations such as the following also plays an important role: Scientific Working Group on Digital Evidence (SWGDE) and National Institute of Standards and Technology (NIST), which develop guidelines on analysis of digital evidentiary material (Szmit, 2018).
The role of a digital forensics expert in court proceedings
In judicial proceedings, a digital forensics expert plays a key role, analysing digital material and preparing an expert opinion for the procedural authorities. As Szmit (2018) notes, such an opinion should be based on methods accepted by the scientific community and the current state of technical knowledge.
More information on the scope of digital forensics examinations, digital data analysis and expert opinions is available on the specialist website:
Digital forensics expert in Kraków—digital forensic examinations
Using appropriate digital data analysis methods is crucial to the reliability of electronic evidence and its correct interpretation in court proceedings.
References
Szmit, M. (2018). About digital forensics standards. Studia Ekonomiczne. Zeszyty Naukowe Uniwersytetu Ekonomicznego w Katowicach [Economic Studies. Scientific Papers of the University of Economics in Katowice], no. 355.