I read this piece on The Economist with interest, specifically around the importance of digital evidence in investigations and how these can be useful sources.

Now of course, I can’t comment on the legal side here and I understand a lot will vary from country to country, and indeed from company to company depending on local legislation. Company policies and procedures will also likely have an impact too.

That being said, when dealing with investigations, this sort of evidence along with traditional forensic evidence from computers, phones, servers, cloud-based systems etc allows for investigators to start to build the fact-base. Using the intelligence and evidence from these sources starts to build a picture of the situation – helping to answer the who, what, where, when, why and how of investigations. In some circumstances this can be a smoking gun document, but more often it helps build a more full picture.

I think it’s important when dealing with these sorts of data sources that not only the legal factors are fully considered and taken on-board, but also that the data and subsequent evidence is dealt with in a forensic manner to ensure that it can be used in any subsequent proceedings. This is where expert help will be needed of course, not just in the collection, but also in the analysis and interpretation to ensure that the correct conclusions are formed.