Meaning
Systematic procedure for the collection and storage of digital or physical data to ensure its admissibility in a court of law. Integrity of information is the primary goal of this legal process. Forensic evidence preservation involves the use of specialized tools and protocols to maintain the integrity of evidence.
It prevents the alteration or destruction of information that may be relevant to a legal investigation. The process creates a chain of custody that documents every person who handled the evidence.
Technical Chain
Mirror imaging of hard drives or cloud servers captures a bit-for-bit copy of the storage media. During forensic evidence preservation, hash values are calculated to prove that the copy is identical to the original. These values act as digital fingerprints that detect any subsequent changes.
Legal Notarization
Chinese courts place a high value on evidence that has been verified by a public notary. When conducting forensic evidence preservation, a notary observer records the process and seals the results. This third-party verification increases the weight of the evidence during trial.
Procedural Requirement
Failure to follow strict handling protocols can lead to the exclusion of necessary information. Proper forensic evidence preservation avoids claims of tampering or contamination. Expert witnesses use these records to justify their findings in court.