2. Four Challenges Of Digital Forensics

forensics community.

2.4 Challenges of Digital Forensics

Digital technology evidence gathering and presentation presents challenges that are inherently different from other kinds of forensic investigations in other fields. Digital evidence is different from evidence that has been created, stored, transferred and reproduced from non-digital formats (Chaikin, 2004). In his study, he showed that the main difference between digital technology evidence and other forms of forensic science practice is the fact that digital evidence can be maliciously or accidentally manipulated by the actors involved thereby nullifying the validity of such evidence in proving the occurrence or existence of crime.

The differences in the nature of digital evidence

As technological advancement continues to outpace the skill acquisition rate of practitioners in the field, the challenge of adequate resource continues to pose as challenge to digital forensics.

Researchers have identified three factors as contributing to the increasing data volume which has become an issue for digital forensic practitioners. These factors are the increasing number of electronic devices available to users, the increase in device memory sizes now available at cheaper costs, and the number of investigations that involve application of digital forensic techniques. Examiners spend larger time closing out investigative cases with huge burdens placed on forensic laboratories.

However, as a way to overcome or limit the impact of this challenge, Rueben et al (2005) offered suggestions that can be adopted. This include; investigators only focusing on acquiring, examining and reporting on the data that is relevant to the case at hand. To determine relevant data, focus on the peculiar nature of the case and knowledge of the investigator can be criteria for making this judgment. As forensics involves working with data to generate relevant evidence, the possibility of applying the appropriate technology is key to ensuring

This layer describes the storage area on the device where the application is stored.

In general, there are three storage locations where social networking applications are stored. The first location is known as the Application Sandbox. The application sandbox is the standard location for most social networking applications; especially applications that run on the android and the IOS operating systems. Data stored on the application sandbox is not accessible to other applications that may be installed on the device; meaning this data is available only to the social network application itself. Represented below are the application sandbox storage locations of Skype on three different device types: o Android Device: /data/data/com.skype.radar o IOS Device: /private/var/mobile/Applications/789888-BCD6-7E5F-1425FDFFDE o Personal Computer: