EmailPrintRegisterWhat's This

Volatility of digital evidence

Digital data are stored in various forms (random access memory (RAM), read-only memory (ROM), hard drives, and other magnetic or optical media) and are subject to inadvertent alteration, degradation or loss. Almost any activity performed on a device, whether inadvertant or intentional (e.g., powering up or shutting down) can alter or destroy potential evidence. In addition, loss of battery power in portable devices, changes in magnetic fields, exposure to light, extremes in temperature and even rough handling can cause loss of data. Due to these factors, steps should be taken in a timely manner to preserve data.

Special precautions should be taken when documenting, collection, preserving and examining digital evidence. Failure to do so may render it unusuable, result in an inaccurate conclusion or affect its admissibility or persuasiveness. 

Activities that should be avoided include the following:

• Putting a Post-it note (adhesive material) on the surface of a CD.
  
• Using permanent markers to label CDs.
  
• Placing magnetic media close to strong magnetic fields (e.g. radio equipment in car trunks, electic motors, computer monitors).
  
• Placing magnetic media in high-temperature environments. Exposing optical media (e.g., CD-ROMs) to light or high-temperature environments.
  
• Exposing media to static electricity (e.g., transporting or storing media in plastic bags, photocopying).
  
• Rough handling of a seemingly sturdy container (e.g., hard drives, laptop computers).