Characteristic Evidence, Counter Evidence And Reconstruction Problems In Forensic Computing

With the ever increasing number of crimes in which computers or other digital devices are used, digital forensics plays an increasingly important role in today's jurisdiction. The acquisition and investigation of the devices is done by forensic experts, whose reports and personal explanations then form the basis of justice. Because of this great responsibility of the experts, the quality of their investigations has tomeet the highest standards. Historically, forensic computing (as digital forensics) developed pragmatically, driven by specific technical needs. Indeed, in comparison with other forensic sciences the field still is rather immature and has many deficits, such as the unclear terminology used in court. In this paper, we introduce notions of (digital) evidence, characteristic evidence, and (characteristic) counter evidence, as well as the definitions of two fundamental forensic reconstruction problems. We show the relation of the observability of the different types of evidence to the solvability of those problems. By doing this, we wish to exemplify the usefulness of formalization in the establishment of a precise terminology. While this will not replace all terminological shortcomings, it (1) may provide the basis for a better understanding between experts, and (2) helps to understand the significance of different types of digital evidence to answer questions in an investigation.