obtained that specifies how the examination will be conducted and which files can be recovered before the electronic device can be examined.
Finally, the analysis of digital evidence differs from other forensic science disciplines because the examination generates not only a forensic report, but also brings to light documents, spreadsheets, and pictures that may have probative value. Different agencies have handled these generated files in different ways: Some treat them as exhibits, while others treat them as derivative evidence that requires a chain of custody and special protection.
A growing number of colleges and universities offer courses in computer security and computer forensics. Still, most law enforcement agencies are understaffed in trained computer security experts.
The term “forensic science” encompasses a broad range of disciplines, each with its own set of technologies and practices. Wide variability exists across forensic science disciplines with regard to techniques, methodologies, reliability, error rates, reporting, underlying research, general acceptability, and the educational background of its practitioners. Some of the forensic science disciplines are laboratory based (e.g., nuclear and mitochondrial DNA analysis, toxicology, and drug analysis); others are based on expert interpretation of observed patterns (e.g., fingerprints, writing samples, toolmarks, bite marks, and specimens such as fibers, hair, and fire debris). Some methods result in class evidence and some in the identification of a specific individual—with the associated uncertainties. The level of scientific development and evaluation varies substantially among the forensic science disciplines.