ELECTRONIC EVIDENCE AND COMPUTER （电子和计算机证据）.pdf

Volume 12, Article 27 October 2003 ELECTRONIC EVIDENCE AND COMPUTER FORENSICS Linda Volonino Information Systems and Telecommunications Canisius College volonino@ TUTORIAL Communications of AIS, Volume12 Article 27 1 Electronic Evidenced and Computer Forensics by L. Volonino ELECTRONIC EVIDENCE AND COMPUTER FORENSICS Linda Volonino Information Systems and Telecommunications Canisius College volonino@ ABSTRACT Information and communication systems are now breeding grounds for electronic-evidence (e-evidence) in audits, investigations, or litigation. Increasingly organizations are being ordered by law or lawsuit to preserve, retrieve, and hand-over relevant electronic records (e-records) because the courts are uniformly recognizing the discoverability of electronic communication and documents [Nimsger and Lange, 2002]. This trend is an outgrowth of aggressive tactics by regulators to ensure corporate accountability and deter fraud. In cases ranging from Securities and Exchange Commission probes of corporate malfeasance and insider trading to employment lawsuits, e-records are subpoenaed. Investigations conducted by the National Association of Security Dealers, Department of Justice, and Department of Homeland Security routinely require companies, their business partners, or third parties to preserve and disclose e-records, including internal e-mail and instant messages (IM). A high