Volatility of Digital Evidence

Digital evidence is more volatile than tangible information because digital data can be altered or destroyed more easily than tangible information. And because digital evidence can be easily altered or destroyed, the integrity of digital evidence must be preserved.

Data that has been altered or destroyed are considered violations of data integrity. What is more, the alteration or destruction of digital evidence is typically irreversible. So, once the integrity of digital evidence has been violated, it usually cannot be restored. Additionally, the failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or, even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.

Digital evidence that is destroyed when litigation is expected, or in progress, might give rise to claims of spoliation of evidence, which, if proven, could lead to monetary fines and sanctions, adverse inference jury instruction sanctions, or dismissal of claims or defenses. SpoIiation is broadly defined as the act of intentionally or negligently destroying documents relevant to litigation. Although digital evidence is different from—and more volatile than--tangible evidence, the rules regarding the admissibility of digital evidence in court are really no different from the rules regarding the admissibility of any other type of evidence.

The rules of admissibility, however, differ in civil law and common law systems. Because civil law systems do not rely on juries like common law systems, there is a relative lack of restrictions on the admissibility of evidence in civil law systems. Thus, there are far fewer limitations on the admissibility of evidence in civil law trials than in common law ones.

Generally, in civil law systems, evidence is admitted if the presiding judge determines it is relevant, even if the authenticity of an item of evidence is in question. But even though any relevant evidence is admissible, the court will evaluate how much weight is to be given to an item of evidence, and courts consider authenticity when determining what weight is appropriate for evidence.

In contrast, the common law contains several rules that restrict admission of evidence. But generally, to be admitted into evidence in common law systems, evidence must, in addition to being established as authentic, be:

1. Relevan to an issue is in dispute in the case: Relevant evidence is evidence that tends to make some fact in issue more or less likely than it would be without the evidence.
2. Material: Material evidence is evidence that has important value to a case or that can be used to prove a point. Repetitive or additive evidence is non-material evidence.

Therefore, if a fraud examiner collects digital evidence, he should be able to state unequivocally that the evidence was not changed in any way by his actions. This requires that strict forensic methodologies be followed to satisfy the stringent evidentiary standards necessary to ensure the integrity of the evidence beyond a reasonable doubt for presentation in court. That is, digital evidence must be properly preserved in a forensically sound manner so that it will be admissible.

Source: CFE Module: Digital Forensic