Search

The discipline of digital forensics requires a combination of skills, qualifications and knowledge in the area of forensic investigation, legal aspects and information technology. The uniqueness of digital evidence makes the adoption of traditional legal approaches problematic. Information technology terminology is currently used interchangeably without any regard to being unambiguous and consistent in relation to legal texts. Many of the information technology terms or concepts have not yet achieved legal recognition. The recognition and standardisation of terminology within a legal context are of the utmost importance to ensure that miscommunication does not occur. To provide clarity or guidance on some of the terms and concepts applicable to digital forensics and for the search and seizure of digital evidence, some of the concepts and terms are reviewed and discussed, using the Criminal Procedure Act 51 of 1977 as a point of departure. Digital evidence is often collected incorrectly and analysed ineffectively or simply overlooked due to the complexities that digital evidence poses to forensic investigators. As with any forensic science, specific regulations, guidelines, principles or procedures should be followed to meet the objectives of investigations and to ensure the accuracy and acceptance of findings. These regulations, guidelines, principles or procedures are discussed within the context of digital forensics: what processes should be followed and how these processes ensure the acceptability of digital evidence. These processes include international principles and standards such as those of the Association of Chiefs of Police Officers and the International Organisation of Standardisation. A summary is also provided of the most influential or best-recognised international (IOS) standards on digital forensics. It is concluded that the originality, reliability, integrity and admissibility of digital evidence should be maintained as follows: Data should not be changed or altered. Original evidence should not be directly examined. Forensically sound duplicates should be created. Digital forensic analyses should be performed by competent persons. Digital forensic analyses should adhere to relevant local legal requirements. Audit trails should exist consisting of all required documents and actions. The chain of custody should be protected. Processes and procedures should be proper, while recognised and accepted by the industry. If the ACPO (1997) principles and ISO/IEC 27043 and 27037 Standards are followed as a forensic framework, then digital forensic investigators should follow these standards as a legal framework.

The discipline of digital forensics requires a combination of skills, qualifications and knowledge in the area of forensic investigation, legal aspects and information technology. The uniqueness of digital evidence makes the adoption of traditional legal approaches problematic. Information technology terminology is currently used interchangeably without any regard to being unambiguous and consistent in relation to legal texts. Many of the information technology terms or concepts have not yet achieved legal recognition. The recognition and standardisation of terminology within a legal context are of the utmost importance to ensure that miscommunication does not occur. To provide clarity or guidance on some of the terms and concepts applicable to digital forensics and for the search and seizure of digital evidence, some of the concepts and terms are reviewed and discussed, using the Criminal Procedure Act 51 of 1977 as a point of departure. Digital evidence is often collected incorrectly and analysed ineffectively or simply overlooked due to the complexities that digital evidence poses to forensic investigators. As with any forensic science, specific regulations, guidelines, principles or procedures should be followed to meet the objectives of investigations and to ensure the accuracy and acceptance of findings. These regulations, guidelines, principles or procedures are discussed within the context of digital forensics: what processes should be followed and how these processes ensure the acceptability of digital evidence. These processes include international principles and standards such as those of the Association of Chiefs of Police Officers and the International Organisation of Standardisation. A summary is also provided of the most influential or best-recognised international (IOS) standards on digital forensics. It is concluded that the originality, reliability, integrity and admissibility of digital evidence should be maintained as follows: • Data should not be changed or altered. • Original evidence should not be directly examined. • Forensically sound duplicates should be created. • Digital forensic analyses should be performed by competent persons. • Digital forensic analyses should adhere to relevant local legal requirements. • Audit trails should exist consisting of all required documents and actions. • The chain of custody should be protected. • Processes and procedures should be proper, while recognised and accepted by the industry. If the ACPO (1997) principles and ISO/IEC 27043 and 27037 Standards are followed as a forensic framework, then digital forensic investigators should follow these standards as a legal framework.

MCom (Forensic Accountancy), North-West University, Potchefstroom Campus, 2017 In cases involving digital forensics, lawyers and judges can find themselves reluctant participants when experts are testifying about the high-level technicalities of digital evidence. Litigators often find themselves in areas that are foreign to them being led by experts whose credibility they cannot assess. In addition, litigators often cannot validate their opinions or findings based on their own competencies (Kessler, 2010:2). In 2002, Ball (2002:6) already observed that litigators could have been “damn good” litigators without knowing the inner workings of a computer in 1992, but by 2002 it was a ticking time bomb in practices without a sound knowledge of computers. A sound knowledge of computers also relates to judges, magistrates, law enforcement officers and forensic investigators in their respective fields. Caloyannides (2003:89-91) together with Van Buskkirk and Liu (2006:25) independently stated that a significant number of judges who admit digital evidence also tend to make the unjustifiable leap in automatically assuming that digital evidence is reliable. This unwarranted high level of reliability assigned to digital evidence by the judiciary can be ascribed to their relative lack in relevant technical knowledge. Presiding officers can find themselves being blindly led by experts without a full appreciation of the impact that a small modification or alteration can have on the interpretation and credibility of evidence (Kessler, 2010:10). In South Africa, very few cases were found where the technical aspects of digital evidence were thoroughly tested in courts. The outcomes of some of these cases were not positive for the State in that the search and seizures were set aside due to a number of unique difficulties that digital evidence pose to conventional search and seizure methodology and statutes. This setting aside of search and seizures can be attributed to the ill-advised application of out-dated physical world rules in a digital world (McLain, 2007:1076). This study considered the reasons why search and seizure warrants for digital evidence were set aside internationally and in South African courts. Case law provides parameters on how courts interpret and provide guidance as to the acceptability of mechanisms employed by forensic investigators during search and seizures for obtaining digital evidence. International guidelines were researched to establish how the unique complexities of digital evidence in search and seizures by global law enforcement agencies are managed while the fundamental principles of digital forensics, such as integrity and reliability of evidence, are maintained. The research study proposes a framework for forensic investigators with regard to the search and seizure of digital evidence, which adheres to the parameters of the South African legislative framework. Although the study is limited to search and seizure under auspices of search and seizure warrants in terms of the provisions of the Criminal Procedure Act (51 of 1977), the parameters found can be applied to all regulatory statutes, which mandate the inspection, search or seizure of data − privately, departmentally and civilly. This study, therefore, addressed all law enforcement officers, government inspectors/investigators and fraud investigators as forensic investigators. The proposed framework sets out the grounds for why the seizure of computers containing all data should be permitted and provides a comprehensive approach for forensic investigators to position authorised officers to apply their mind when evaluating if sufficient ground exists to permit the required infringement of the rights of suspects. The framework shows that although search and seizures are permitted, strict measures should be employed to ensure that forensic investigators do not gain access to more data than authorised in terms of search and seizure warrants Masters