Subject: Digital Forensics

Topic: Preserving and Recovering Digital Evidence

Difficulty: High

Real Evidence: Real evidence is any evidence that speaks for itself without relying on anything else. In electronic terms, this can be a log produced by an audit function—provided that the log can be shown to be free from contamination.

Testimonial Evidence: Testimonial evidence is any evidence supplied by a witness. As long as the witness can be considered reliable, testimonial evidence can be almost as powerful as real evidence.

Hearsay: Hearsay is any evidence presented by a person who was not a direct witness. Hearsay is generally inadmissible in court and should be avoided.

Evidence locations are as follows -

1. Internet History files

2. Temporary Internet files

3. Slack/unallocated space

4. Buddy list, personal chat, P2P,etc.

5. News groups/ club list/ posting

6. Setting folders structure and file name

7. File storage dates

8. Software and hardware added

9. File sharing ability

10. emails