Maintaining digital evidence entails no more than keeping a copy of the evidence.

From a legal perspective, maintaining digital evidence is more difficult than maintaining physical evidence.

Ensuring the chain of custody for digital content does not involve an additional act of copying or physical transformation.

A copy of any digital evidence must be retained by the prosecutor’s office.

U.S. Attorney’s Office

attorneys for the pharmaceutical company

attorneys for the suspected distributor

local police

telephone.

e-mail.

letters.

faxes.

“recovery.”

“report writing.”

“debriefing.”

“lessons learned.”

precedent.

legal authority.

preponderance of evidence.

chain of custody.

having the case closed immediately or having it go to trial.

a prison sentence or probation.

winning a court trial or the judge declaring a mistrial, and losing the case and legal costs.

life in prison or the death penalty.

was involved in a crime.

was destroyed in a crime.

is dangerous to the public.

could be considered offensive.

The distributor was laundering money.

The distributor was purchasing drugs from U.S. sources to be sold abroad.

The distributor was operating unlicensed pharmacies and nursing homes.

The distributor was operating licensed pharmacies and nursing homes.

The diversion was being done for about two years.

The diversion was being done for less than five years.

The diversion was being done for less than eight years.

The diversion was being done for more than 10 years.

warrant authorizing

chronological documentation showing

process involved in

individual(s) responsible for

Its representatives in certain geographic areas began complaining that sales of normally high-volume drugs were slowing down considerably.

The police notified them that counterfeit drugs that looked like the ones they manufactured had been discovered.

Nursing homes began complaining that the drugs were ineffective.

A number of patients who used the drugs died.

a “wealth of information,” including documented proof that drugs were being diverted from purchasers in Europe and Canada, and being sent to the United States.

only that the drugs were handled by a legitimate drug repackaging and export company.

only that the distributor was repackaging vitamins in a legitimate fashion.

that the distributor was diverting drugs from purchasers in Europe and Canada and sending them to the U.S., but that the activities were very limited in scope.

So they can return it to its rightful owner

So they can prove who the rightful owner is

In case the object is used as evidence for a trial

In case the object was used in other crimes

multiple versions of

similar but not exact

forensically sound

significantly different

a different object than the one confiscated by the police.

indeed the same object confiscated by the police.

going to be returned to its rightful owner.

no longer important to the case.

no

dozens of

hundreds of

thousands of

security incident response form

chain of custody

security policy

line of command

It is easier to figure out how long the evidence has been held with a time/date stamp.

It is important to document that the evidence was being controlled at all times.

A time/date stamp can help investigators determine the time and date that a crime was committed.

It is not important to include a time/date stamp.

There is no chain of custody requirement for electronic evidence.

The requirement is the same for electronic evidence as it is for physical evidence.

The requirement is different for electronic evidence than it is for physical evidence.

It is not possible to show the chain of custody for electronic evidence.

cash

thousands of paper records

guns

computers and other electronic equipment