Methodologies

The research team first conducted an in-depth study of the writings concerning electronic evidence to establish clearly and thoroughly what are the problems presented by existing legal requirements and to assess the validity of the proposed solutions on the basis of this research program’s theoretical framework. Next, the team analyzed the Computer Forensics scholarly literature and professional writings to identify the various branches of this profession, and the most representative experts from each of them.

The review of the literature resulted in a bibliographic database that served as a fundamental resource (continuously enriched and maintained as a research product throughout the course of the project) for the research program, and guided the team in compiling questions for semi-structured interviews with representatives of the legal, law enforcement, and computer forensics communities. From interviews with computer forensics experts the research team identified the criteria that these experts consider to be the basis for determining the trustworthiness of digital evidence and what methods they believe must be used to maintain digital evidence as trustworthy from the moment they start examining its digital environment. On the basis of the results of the experts’ interviews and of its own legal and Archival Diplomatics knowledge, the team created discipline-specific interview protocols aimed at establishing shared beliefs about the fundamental means of establishing and maintaining record trustworthiness and discovering the gaps and the problematic areas in existing knowledge. The team invited members of the computer forensics, law and information professions, and selected members of the public (e.g., journalists and scholars), to participate in semi-structured interviews based on these protocols. The team then analyzed the responses in order to compile the findings.

The research also conducted an ethnographic study, which involved examining the context and procedures in the management of digital evidence at the Vancouver Police Department. Graduate research assistants, under the direction of the team’s experts in the Law of Evidence and in Digital Forensics, researched and described the hierarchy for policy changes and decision-making, the current court procedures governing the admission of digital evidence and the problems noted by the personnel of the evidence room. The team used the findings from the questionnaires as points of reference for studying the environment and the basis for interviews with the professionals working at the Department. As both the ethnographic approach and the case studies methodology action research, the team collaborated with the subjects of the investigation, who thus became co-participants and stakeholders in developing practical methods and new knowledge.

Concurrently, the team Diplomatics expert interviewed Classical Diplomatics scholars to discover how they envision the application of their knowledge to digital evidence and what part of their discipline, if any, should become a component of a program of education in digital records forensics.

Finally, the team synthesized its findings and the new knowledge generated in the process of the research into structured content for a Digital Records Forensics discipline. The outcomes include an IDEF0 model of digital forensics investigation that is harmonized with archival diplomatics in order to identify and include moments at which authenticity of digital materials may be assessed, protected, and preserved, and curriculum materials for graduate level courses in digital diplomatics and digital records forensics.