In recent years forensic computing has greatly
evolved, moving from a pseudoscience to a recognized discipline with skilled
practitioners and guiding principles relating to the conduct of their activities.
The law states that “possession is nine-tenths of the law,” and because
computer based data can be so easily and undetectably modified during its
collection, impounding, and analysis; certain new “rules of evidence” have been
enacted, evolving from more general codes of practice. These new rules deal
with a verifiable chain of custody
that must exist in regard to digital evidence. For example, according to the
U.S. House Advisory Committee on Rules, its rule 1003 (Admissibility of
Duplicates), “a counterpart serves equally as well as the original, if the
counterpart is the product of a method which insures accuracy and genuineness.”
