Digital forensic process: Difference between revisions

Revision as of 07:16, 27 October 2021

Revision as of 20:31, 6 June 2023

Line 71:

}}</ref>

Once evidence is recovered the information is analysed to reconstruct events or actions and to reach conclusions, work that can often be performed by less specialized staff.<ref name="ijde-2002" /> Digital investigators, particularly in criminal investigations, have to ensure that conclusions are based upon data and their own expert knowledge.<ref name="casey" /> In the US, for example, Federal Rules of Evidence state that a qualified expert may testify “in"in the form of an opinion or otherwise”otherwise" so long as:

{{quote|(1) the testimony is based upon sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case.<ref name="rule702" />}}