Validation of forensic software as computer forensic evidence

In criminal cases, judges confronted with questions of technical order in computer technology, designate expert witnesses who put their expertise at the service of justice.

Duly appointed by the courts, they help the judge by providing evidence relevant to the investigation. They search the suspect's seized digital devices for elements of computer related crime, while preserving the integrity of the data and avoiding any alteration of the original media. The evidence thus collected is analyzed by a digital forensic expert who will document their findings to the judge in a report.

Technical investigations are conducted by using powerful and sophisticated tools to find the current files and recover deleted, hidden or encrypted data from the digital media device examined.

This requires perfect control of the utilized equipment and a clear identification of the methods used during the analysis.

This research project aims to highlight the technical challenges which experts face, the complexity of digital forensic tools used for technical investigations, and the importance of their validation to understand the capabilities and limitations of each tool