Gradually, as computers entered the mainstream and computer crimes became more complex, forensic methods changed. Today, with recent statistics from the Meta Group indicating that the vast majority of all documents are stored digitally, the science hinges almost entirely on computers themselves. To extract a deleted memo, for instance, they can scan thousands of hidden backup folders for certain key words. We sure have come a long way from sending the secretary to rifle through the trash. Despite this evolution, a key aspect of the science, called chain of custody, hasn't changed at all.
Chain of custody is the record of who had possession of the evidence and what they did with it.
While this provision is intended to protect the defendant from evidence tampering, the requirements can hurt the plaintiff if the evidence is mishandled. Details are still sketchy, but experts familiar with the case allege that employees from one or more of the computer security companies that handled the break-in inadvertently altered access times on log files from the day of the attack. If you do that to the only copy of a file that's critical to a case of computer crime, you've just ruined your evidence. First, as with any other crime scene, it's crucial that no one disturb the evidence. To ensure that evidence is processed safely and to eliminate discrepancies in the industry, investigators follow a standard four-step regimen.