Practitioner note: Preserving cyber investigation evidence – the screen tool witness signature
Benjamin Wright · Digital Evidence and Electronic Signature Law Review · 2014
Commonly, a cyber investigation examines how a digital resource, such as an application, a hyperlink or a web search box -works.For example, the investigator observes that when mouse clicks on hyperlink 'X' browser goes to a web page containing 'Y' content.The investigator observes how a resource works.The investigator wants to record what he sees and hears.He wants the recording so he can establish to a third party such as a court what the resource did at the time of the investigation.Without a recording, valuable evidence can disappear.A web page or a Facebook wall, for instance, may display one thing now and something different five minutes later.