Thereare 4 evidence lifecycle to investigate the employee’s computer, there arepreparation, evidence collection, preservation, examination and analysis andpresentation.
Firstly, the preparation. In the court, as an investigator needsto declare in which to disturb the evidence seized, thus, to filing seize theevidence by the authorities that must be collected. (Subramaniam, n.
d) At thescene, as an investigator should interpret the media description that likelydetected. Furthermore,to conduct a brief preliminary that can be accomplished with the suitable party.Deliberately, the preparation phase may contain the responsibilities andborders installation, and to recommend the client on the impact and thesuggestion that may contain investigation conclusion.
(Subramaniam, n.d.) Secondevidence lifecycle is evidence collection. Device’s documentation is in the settingand investigator’s journal should be made. Moreover, the number, the date ofthe evidence that be delivered by the label management. Therefore, to interviewwith the user of the system that obtain the computer’s IP address, which theinvestigation collaboration. Furthermore, to recognize the evidence cause whichhardware and software that be used by the investigator when it’s applicable, forensicallyand effective for the evidence breakdown A write-protected manned is acquiredby the evidence which can be achieved The authority need to be used to identifythe software to control the development of the disk acquisition and imaging.
Todevelop an image of the suspect’s disk can be prepared by the softwareespecially when the suspect’s disk duplicate. (Subramaniam, n.d.) Preservation:The original data has to be completely non-invasive that be used by theforensic method.
At the same time to duplicate files which to ignore the filesand information prosperity. Therefore, to duplicating the copies the files canbe visible as well as it difference from free space which may contains hiddendata, hidden partitions that contains hidden data, slack space, registry info, unallocatedspace, temporary files, hidden files, , history files and etc. (Subramaniam,n.
d.) Furthermore,the examination and analysis is at this stage the result isdepended by the outstanding closing case, prosecution, settlement or conviction.Additional during this development a due care must be taken and to avoid anyoccupied with the original evidence. (Subramaniam, n.
d.) Lastly,the presentation, which the findings must be presented simultaneously manner thatmay include screen captures, original files and etc. Furthermore, clearevidence information with the techniques simultaneously. (Subramaniam, n.d.) Theadmissibility of evidence comes in four basic forms that are demonstrativeevidence, documentary evidence, real evidence and testimonial evidence.
Firstoff demonstrative evidence, with efficiency enough for the task at hand,correctly and adequately to express testimony and in another way isunobjectionable and it will be admissible. Examples of demonstrative evidenceare diagram and the scene of an occurrence description. As a result of itspurpose is to clarify testimony, the witness whose testimony is beingillustrated authenticates the demonstrative evidence. (Findlaw, n.d.
) Anotheradmissibility of evidence is documentary evidence: The method of using documentthat is genuine whereas the same as any other real evidence. Moreover, the ruleof evidence most highly contributed of where writing is being offered inevidence, thus, a copy or the content’s other secondary evidence, which willnot be received in document distribution but the clarification that is offeredfor the original insufficiency. (Findlaw, n.
d.) Furthermore, Real evidence: Anaction which based on the real evidence to convince the terms and the defendant’sperformance. If it is written in a stumble way, as a result it may be relevantto be presented. When real evidence that needs to be admissible, it must berelevant, competent, and material.
(Findlaw, n.d.) Lastly,testimonial evidence. To view the problem that were questions of competenceconnection and therefore evidence expulsion in which presenting in preferencequestions of weight for accomplishment to classify, furthermore, competenceguidelines are interpret and it will be affected in the exclusion of evidence. (Findlaw,n.d)