EVIDENCE anything found on a crime scene that has the potential to give a clue to reconstruction is known as evidence. Also know in some quarters as artifact, trace or trail, evidence is anything that can be used to track the cause of crime.

In typical murder cases, the splash pattern of blood stain is an evidence, so are hair strands on abandoned wrist watches. In some cases highly sophisticated form of inference is employed to deduce action from perfume fragrances.

When evidence appears in the form of computer data or resides in computer media or electronic repository, it is regarded as digital evidence. As an example a computer-generated bank statement may be regarded as digital evidence in a litigation involving financial crime or falsification of financial record. In this case admissibility of the digital evidence in a law court becomes a matter of local jurisdiction norms.

Similarly, call logs and sms queues in a cell phone or PDA can become digital evidence in matters of telephone threat crimes.

Reconstruction
In Forensic studies, a widely-used technique of investigation is the replay of an event; this is also called reconstruction or recreation. Reconstruction is the process of restoring something to an earlier state. In Forensic practice, reconstruction is an attempt to understand in details how certain events took place or happened, given a crime scene.

Crime scene reconstruction is the use of scientific methods, physical evidence, deductive reasoning, and their interrelationships to gain explicit knowledge of the series of events that surround the commission of a crime.  It is somewhat synonymous to reverse engineering whereby the cause is retrieved by working back through the effect (result).

Reconstruction is a very methodical and principled approach towards objectively understanding a crime using evidences found at a crime scene, hence the incident can be reconstructed to determine what happened, and possibly find more clues.

In the process of reconstructing an event, every item or info that shares any relationship with the subject under investigation is taken as a potential source of evidence. This is why a crime scene is usually cordoned off to prevent a possible damage, loss or interference with evidence.  Cordoning off is usually the first stage of evidence isolation.

Specifically in computer forensics, cordoning is achieved through isolation of the digital media being investigated.
Chain of custody

Performing forensic examination is a very tedious process that involves adherence to global best practices. These best practices are followed in a specific sequence starting from the gathering of evidence through the point of tendering evidence in court.

The entire process during which the object(s) of investigation is/are kept secure without tampering is called chain of custody. In other words, chain of custody is the summation of all the activities and processes that are conducted from inception till the conclusion of a forensic analysis.

It is a process used to maintain and document the chronological history of evidence, and it represents the record of a sample, including its collection, preservation, transportation, transfers, analysis and final disposal as method of keeping track of who has handled a piece of evidence, when, and for what purpose. Chain of evidence is very vital in ensuring that evidence is not damaged or altered in any way while investigation goes on.

Effective chain of custody involves the chronological documentation or paper trail, showing the seizure, custody, control, transfer, analysis, and disposition of evidence, both physical and electronic. This also includes the policies and procedures that govern the collection, handling, storage, transportation, testing, analysis and submission of evidence.

Because evidence can be used in court to convict persons of crimes, it must be handled in a very careful manner to avoid later allegations of tampering or misconduct which can compromise the case of the prosecution toward acquittal or to overturning a guilty verdict upon appeal.

The idea behind recording the chain of custody is to establish that the alleged evidence is in fact related to the alleged crime, rather than having, for example, been planted fraudulently to make someone appear guilty.

Root cause analysis

This is the process of carrying out a thorough review of a disaster, problem, a crime or crisis in order to identify the elements of its cause, study the impacts of its effects on the system, set up measures to mitigate these effects and finally recommend possible solutions to prevent its reoccurrence. Root cause analysis is one of the many goals of forensic examination.

Performing a forensic exercise will help to establish a pattern which the adversary might have followed to perpetrate a crime, or to identify the human or systemic error that could have led to a damage, a crash or a failure.

Computer forensics

Computer forensics is the application of computer investigation techniques to thoroughly analyze digital media, software program, suite of applications, computer network resources, or a group of related cyber activities and therefore gather evidence suitable for presentation in a court of law.

The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a digital medium or data component and who was responsible for it.

Computer forensics is also known in certain quarters as Cyberforensics, digital forensics, digital analysis, data query.

Kenneth Okereafor is a Computer Information Systems Security Professional.