The benefits of forensic examination in the IT sector cannot be emphasised enough. Digital evidence that is correctly examined, processed, collated and presented can be as compelling as any other, for police investigations and ultimately in court. It can provide a digital ‘smoking gun’ upon which a perpetrator may have left his and members of his group’s ‘prints’. However, the challenge in the digital age is that this evidence must be obtained in a manner not open to doubt through means derived or presented. It must be clear and under-standable by both non-technical judiciary and the jury.
The technical, legal and procedural challenges facing the investigator and prosecution should not be under-estimated. The examination must be conducted thor-oughly and strategically against the clock, with limited resources and direction. There is neither the time nor resources to waste on blindly examining raw data which may amount to gigabytes of information. Put bluntly, a small office network of a server and 10 PCs can easily hold a terabyte (1,000 gigabytes) of information, or 20 million pages of text. Clearly, some automated assistance is required.
