Hearsay

• Federal courts generally regard computer records as hearsay evidence, meaning the evidence is either indirect or second-hand. As a result, computer record evidence in most cases is treated no differently than evidence collected from an overheard conversation, letters, diaries or testimony not given under oath.
  
  

Admissibility

• The admissibility of digital evidence is entirely dependent on exceptions to the hearsay rule. The business-record exception allows admission of digital evidence as long as the records are of business that has been conducted regularly. This exception allows certain kinds of digital records such as memos, business records and reports, and other regularly entered data to become admissible in a court of law.
  
  

Computer-Generated Records

• Digital computer records are divided into two categories: computer-generated records and computer-stored records. Computer-generated records cover all that data that the computer system uses to keep track of itself; log files and proxy server logs, for instance. These records are not created by the user, but are automatically produced by the system itself. Computer-generated records usually are considered exempt from the rules of hearsay if the program that created the records is operating properly.
  
  

Computer-Stored Records

• Computer-stored records are electronic data that have been created and stored by the user. Examples can range from e-mails to spreadsheets to documents to video files. A computer-stored record must satisfy an exception to the hearsay rule, most often the business record exception. In addition, it must be proved that the records were not altered either at the time they were acquired or at any point afterward.
  
  

Best Evidence Rule

• All digital evidence is by nature actually nothing but a series of 0s and 1s, which allows some attorneys to question the validity or authenticity of printed documents. Digital evidence that can be held in the hand can be obtained only through a complicated series of electronic processes. Printouts and other tangible evidence typically qualifies under the best evidence rule, but digital evidence is always open to challenge.
  
  

Digital Signatures

• In order to maintain the integrity of digital data, a digital signature must be acquired. A digital signature is simply a unique identity code of a single file or an entire disk filled with files. The method for obtaining a digital signature varies. These signatures must be produce before a file is processed and then another digital signature must be produced after the evidence has been analyzed.
  
  

Seizing Digital Media

• A proper search warrant must be shown before any digital media can be seized legally. In most cases search warrants are written to cover all digital components, meaning that the computer can be seized along with peripherals like disk drives, compact discs and DVDs. The search warrant giving police the right to seize digital media may not necessarily extend to printed documents, so be sure to check the specifics of the search warrant when you handed it.