Examination of electronic evidence

Correspondence and web pages

Examination of a digital package

• Contents and structure of files, messages and attachments.
• Available metadata and timestamps.
• Comparison of copies and technical indicators of discrepancies.
• Acquisition conditions, identity of materials and reproducibility of recording.

Questions for examination

• Which objects are included in the digital package provided?
• Does the content of the compared files and messages match?
• Which indicators allow the origin and acquisition sequence of the materials to be described?
• Which source data are insufficient to answer the questions raised?

Which result is needed

Before starting, we establish whether the task requires preservation of an accessible state, a technical description, examination of specific characteristics or review of an existing report. A notary handles notarial preservation of evidence; a technical examination is issued as a separate document.