Home page / Computer Forensics / Evidence Documenting

 

Evidence record is the most important document in the process of collecting evidence. It contains a complete list of items discovered and gathered as evidence on the scene. A detailed description of each item submitted for examination is made, including data and time of item acquisition.

Digital evidence must be described in details in order to make a distinction between similar items and therefore it contains serial number and/or other appropriate ID labels. Evidence record should also include track of digital evidence transfer from one person to another.

The process of creating and monitoring changes in custody is essential for preserving the chain of custody of digital evidence.