We were asked recently about best practice in digital forensics regarding the integrity of the information handled in the course of an expert examination. As we know, integrity is a crucial condition if the digital evidence handled is to keep its legal value. In Québec, the Act to establish a legal framework for information technology (“LCCJTI”) states precisely that the integrity of “technology-based documents” must be assured if they are to retain the same legal value. Here are a few relevant sections:
5. (…) A document whose integrity is ensured has the same legal value whether it is on paper or on another medium, insofar as, in the case of a technology-based document, it otherwise complies with the same legal rules.”
6. The integrity of a document is ensured where it is possible to verify that the information it contains has not been altered and has been maintained in its entirety, and where the medium carrying that information provides it with the required stability and durability. The integrity of the document must be maintained over the course of its life cycle, that is, from its creation, through its transfer, consultation and transmission, and up to its retention, including its archiving or destruction. In assessing integrity, consideration is given in particular to the security measures taken to protect the document over the course of its life cycle.” [ Our emphasis]
15. To ensure the integrity of a copy of a technology-based document, the process used must offer sufficiently serious guarantees to establish the fact that the copy contains the same information as the source document. In assessing the integrity of the copy, consideration is given to the circumstances in which it was made, and to whether it was made systematically and without gaps, or in accordance with a process based on technical standards approved by a recognized body referred to in section 68.”
The experts who collect, analyze and handle digital evidence in the course of a computer examination have the experience and the skills required to use specialized digital forensics devices (or software) that guarantee the integrity of the data gathered: these devices are designed or certified as such by various bodies (Tableau, Encase, and so on). They therefore offer “sufficiently serious guarantees” to establish the integrity of a document relative to the source document. This software is, moreover, in frequent use in the field for such examinations.
A strict methodology must also be followed according to the rules of the art, including the protocols for taking possession, collection, extraction and analysis, before any expert report is produced, in order to demonstrate the chain of custody where required. Several tools also serve to secure the exchanges between the client and the expert. At OKIOK, the secure transfer solution S-Filer Portal is used to protect the data and to keep track of the communications and the data exchanged in the course of an investigation.
To close this brief note, a party that has not carried out an examination on the data it wishes to enter in evidence should make sure it is possible to verify that the evidence has not been altered and has been maintained in its entirety. If the opposing party validly contested its integrity, that party would be obliged to make out that case.
About OKIOK
World pioneer and Canadian leader in information security for more than thirty years, OKIOK delivers a complete range of services and products, including secure data transfer, identity management and computer forensics. Its vast offering takes the form of consulting services, outsourced security management, commercial and custom solutions. Amongst the few firms in Canada to make research and development its cornerstone, OKIOK stands at the forefront of the sector through on-going innovation.
For more information, visit www.okiok.com or contact us at (450) 681-1681.