Podcast: Play in new window | Download
I’d like to discuss evidence recovery, specifically digital media evidence recovery. Having a forensic expert retrieve the evidence maintains the quality of the evidence. It also ensures that the original evidence stays intact on the original system so it can later be retrieved by other parties. This is why it is extremely important that only a trained expert retrieve the evidence.
In this podcast episode, I will cover proper procedures for evidence retrieval, proper handling of the evidence, and what precautions one should take when retrieving digital media evidence from a recording system.
5 Steps for Proper Evidence Retrieval
1. Research before retrieving the evidence. The forensic expert should learn everything they can about the recording system beforehand. Connecting with the manufacturer, reading the manual, and researching further online all benefit the expert. This will make analyzing and operating the system onsite easier for the expert and optimize the retrieval process.
2. Obtain any necessary software, proprietary player or codec. If the system records proprietary or encoded files, the expert should obtain the player or codec beforehand. If that is not possible, the expert should be prepared to install the necessary player or codec onsite from either the recording system or client. More often than not, modern digital surveillance systems require a special codec or proprietary player and without this installed, the forensic expert will not be able to access the digital media evidence.
3. Record the evidence retrieval process. The forensic expert should record both audio and video of the evidence retrieval to include in the chain of custody and forensic report. When I am recovering evidence from a digital recording system, I always have a VIEVU body camera on my person, as well as a digital audio recorder in my pocket. Along with authenticating the evidence, this can serve as the expert’s notes later on in the investigation in case they need to refer to something that was discussed during the evidence retrieval.
4. Photograph and inspect the digital recording system. The forensic expert should include photographs of the unit in their report and take careful notes on anything they notice about the unit. This could include damage, tampering, or any other abnormalities they notice on the recorder. Along with the video recording, it is usually beneficial for the expert to photograph anything they note during the process.
5. Follow the manual for the highest quality retrieval. The expert should have the manual with them when retrieving the evidence to make sure that any copy or export is in the highest quality format and does not affect the original recorded file.
Listen and Subscribe to the POdcast
Listen to the Blindspot podcast now and subscribe to receive the latest episodes downloaded to your computer or portable device.
