How to acquire forensic evidence in the digital era

The acquisition of digital forensic evidence of web content, websites, social profiles, such as Facebook, Instagram, Twitter or any other, blogs, portals and forums, constitutes a great demand today since it allows one to “freeze” content, who’s very nature is dynamic, into static content before it can be modified and / or even removed.

The process is strategic in the context of IT appraisal because it guarantees that the content in which the parties (CTP, CTU, CT of a PM, Judge, Public Prosecutor, etc …) are interested in analysing and assessing, is acquired according to pre-established norms and through the use of correct methodology.

The extracts acquired, called “forensic copy”, “certified copy”, or “legal copy”, will substantially constitute a copy (as complete as possible) of elements with probative value that guarantee preservation of the original data and prevent alteration. Therefore they are considered copies of the original suitable for exhibition in court.

Legal cases based on non-certified data may present vulnerabilities as the integrity of the data and the invariability of the same, may be questioned. Thus, the data must be subjected to a “compliant cloning process” guaranteeing non-alteration of the original data.

There are many cases in which the acquisition of digital evidence is required: defamation, slander, obloquy, threats, stalking etc.

In Italy, the law that technically regulates the acquisition phase of digital evidence is Law 48 of 2008, which contains the ratification of the 2001 Budapest Convention.

The eWitness solution: Web Freeze

The Web Freeze, is a solution that allows to obtain a static representation of an online web browsing session, generating a log of the steps carried out in compliance with the conditions and permissions which one adhered (for example, excluding the execution of script pages).

The static representation obtained, together with the navigation log, can be converted into PDF format, signed by a Notary (Notary Certification), thus creating a certified copy of the web page.

This digital document, endowed with a real certified legal value, can be printed in paper or used in native digital format to be exhibited in court.

The use of web freeze allows to keep an indelible trace of all browsing sessions carried out by a specific terminal or, possibly, by a series of terminals.

It is important to mention that the monitoring of web browsing must be carried out in full compliance with the law in force and in particular with the GDPR regarding the processing of personal data.

The advantage of the eWitness solution, is the presence of the Notary who, as a Public Official, shifts the burden of proof to the counterpart, guarantees with certification the opposability of third parties until proven otherwise and validates the date of when the copy was generated.