What is Forensically Sound Evidence?

'Forensically sound' is a term widely used in digital forensics and electronic discovery. A 'forensically sound copy' may be required for ESI to be admissible in court.

Rodney McKemmish is a former director of KPMG Forensic. His chapter "When Is Digital Evidence Forensically Sound?" for Advance in Digital Forensics IV, provides a precise definition of the term. See, McKemmish, R., 2008, in IFIP International Federation for Information Processing, Volume 285; Advances in Digital Forensics IV; Indrajit Ray, Sujeet Shenoi; (Boston: Springer), pp. 3–15, available at, https://link.springer.com/content/pdf/10.1007%2F978-0-387-84927-0_1.pdf . McKemmish reviews several authorities, including NIST’s Disk Imaging Tool Specification, and the Department of Justice's guide Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations. He gives four criteria for the term:

1. Has the meaning and, therefore, the interpretation of the electronic evidence been unaffected by the digital forensic process?

The binary data can not be changed. It will not necessarily matter that dates and times are displayed in different formats than are shown for the original data.

2. Have all errors been reasonably identified and satisfactorily explained so as to remove any doubt over the reliability of the evidence?

A forensic examiner has to identify and document errors in the process. Any changes must be accounted for. For example I/O errors should be recorded. These are Input/Output actions (e.g., reading or copying data) in accessing disks and drives.

3. Is the digital forensic process capable of being independently examined and verified in its entirety?

An audit trail should be created that outside parties can review.

4. Has the digital forensic analysis been undertaken by an individual with sufficient and relevant experience?

Only specialists should acquire the evidence.