Electronic evidence.
Electronic evidence is material evidence of a very special form and specific features: exceptional ease of changing and modifying these data, the possibility of a copy identical to the original. They consist of any information appearing in the form of data in digital form - the subject of the proceedings. The most important is adequate protection of evidence - execution of the so-called binary copy and authentication using the so-called checksum.
Electronic evidence from damaged storage media.
It is possible to obtain electronic evidence even after deleting data and from damaged (physically or logically) storage media. It does not matter if it's a laptop drive, computer, server, disk array, camera, etc. - data is recoverable. From devices equipped with memories based on NAND technology (mobile phones, smartphones, memory cards), the data is read directly from memory chips (CHIP OFF). This method is extremely effective in all cases where standard software methods fail (it allows reading information without the device controller). The obtained or recovered digital evidence may be used by: law enforcement agencies, law offices, detective offices, companies, natural persons (in order to obtain materials for divorce and maintenance purposes) and business clients - representatives of corporations and small and medium enterprises, in particular in cases of theft company data. Electronic evidence can be used in criminal, economic, civil, private and employee cases. Complement of activities carried out as part of computer forensics may be white intelligence (OSINT - open source inteligence investigation) consisting in obtaining information from public sources.
