Electronic Evidence and Computer Forensics

Information and communication systems are now breeding grounds for electronic-evidence (e-evidence) in audits, investigations, or litigation. Increasingly organizations are being ordered by law or lawsuit to preserve, retrieve, and hand-over relevant electronic records (e-records) because "the courts are uniformly recognizing the discoverability of electronic communication and documents" [Nimsger and Lange, 2002]. This trend is an outgrowth of aggressive tactics by regulators to ensure corporate accountability and deter fraud. In cases ranging from Securities and Exchange Commission probes of corporate malfeasance and insider trading to employment lawsuits, e-records are subpoenaed. Investigations conducted by the National Association of Security Dealers, Department of Justice, and Department of Homeland Security routinely require companies, their business partners, or third parties to preserve and disclose e-records, including internal e-mail and instant messages (IM). A highprofile example is the probe into alleged White House leaks of a covert CIA agent's identity in which White House employees received e-mail stating: ''You must preserve all materials that might in any way be related to the department's investigation.'' E-mail, telephone logs, and other electronic documents were mentioned specifically. Any communication or file storage device is subject to computer forensic searches to identify, examine, and preserve potential e-evidence—the electronic