Forensic Fundamentals, Legal and Ethical Considerations
Forensic Fundamentals
What makes work "forensic"
Forensic soundness rests on three pillars: the process must not alter the source, it must be documented well enough for an independent examiner to repeat it, and every action must be attributable to a person and a time. The widely cited ACPO principles capture this: no action should change data that may later be relied on in court; where change is unavoidable, the examiner must be competent and able to explain why; an audit trail must exist; and the case officer holds overall responsibility.
Locard's exchange principle - every contact leaves a trace - cuts both ways. The suspect leaves traces on the system, and the examiner leaves traces on the system. Live analysis, mounting a disk, and even plugging in a USB device change state, so document every interaction.
Core concepts you must be able to distinguish: order of volatility (CPU registers and cache → RAM and network state → running processes and temp files → disk → logs on remote systems → backups and archival media); hashing for integrity; write-blocking; chain of custody; tool validation; and cognitive bias controls such as peer review and hypothesis testing.
Traps
A hash proves the data has not changed since it was hashed - not that it is authentic, complete, or true. "Forensic image" does not mean "admissible"; admissibility is a legal question. Order-of-volatility questions often place the hard disk before RAM as a distractor.
Rule of thumb: if data cannot be recreated and will vanish on power loss, capture it first; if it is persistent and can be imaged later, secure it and leave it alone.
Worked example: a compromised server is still running. Capture RAM and current network connections before powering down or imaging disks, then image the disks with a write blocker, and record the sequence and timestamps of each step in your notes.
Legal and Ethical Considerations
Authority comes first
Before touching a device, establish authority to search: a warrant, valid consent, a subpoena or court order, or a written corporate policy plus employer ownership. Authority is scoped - a warrant for a specific account does not authorize a whole-disk fishing expedition. Consider jurisdiction when data crosses borders; stored data may sit in another country and require mutual legal assistance or a provider-based legal process. Privacy regimes such as GDPR and the CCPA constrain what you may collect, retain, and transfer, and require data minimisation.
Know the rules of evidence concepts that recur: authentication (can you show this is what you say it is?), hearsay and its business-records exception (automatically generated logs kept in the ordinary course are commonly admissible with custodian testimony), the best-evidence rule and its treatment of duplicates, and privilege (legal advice, medical, journalistic material) which may require filtering.
Expert evidence standards differ: US courts apply Daubert (testability, error rate, peer review, general acceptance) or Frye (general acceptance) depending on jurisdiction; other countries have their own frameworks.
Traps
Employer ownership does not automatically permit searching personal accounts or personal devices. A user's consent may not cover a third-party cloud provider. A break in chain of custody does not automatically exclude evidence - it usually goes to weight, not admissibility. Ethics questions probe impartiality, conflicts of interest, confidentiality, and the duty to disclose findings that undermine your own client's case.
Worked example: server authentication logs generated automatically and retained for 12 months are typically admitted under the business-records exception, supported by a custodian's declaration describing how they are created and stored.