Page 3
Guides and news on digital evidence.
Articles from C.E.R.T.O., LOCUS and Probatio: each card leads to the guide or news item on the site that publishes it. The three programs →
-
Looking inside a ZIP archive without extracting it
An archive received as evidence is not opened with a double click. Extracting creates new files, the system's archive handler says false things and an entry's name has several readings: here is what is really inside a ZIP.
Read → -
The date of a photo: why your phone clock proves nothing
Changing the system date, taking the shot and setting it back takes thirty seconds. Here is why a date you gave yourself is not a fact — and how to get one that holds up against you.
Read → -
Chain of custody for digital evidence: what and how
You can have the right content and still lose, if you cannot show it reached the courtroom intact. The chain of custody is exactly that: the concept every professional should understand.
Read → -
EXIF metadata: what it actually proves (and what it does not)
EXIF is the first thing everyone checks and the last thing to lean on. It is text, rewritable in seconds with free tools: excellent as an indication, useless as a guarantee.
Read → -
Forensic images E01 and dd: differences and checks
«I made a copy of the disk» means nothing. Copying files skips unallocated space and bad sectors. A forensic image is a sector-by-sector transcription of what is on the medium.
Read → -
Email as evidence: proving content, date and integrity
An email can decide a case: a contract, a cancellation, a dispute. But forwarding or printing it is not enough. Here is what makes a message truly disputable-proof.
Read → -
How to prove a photograph has not been edited
Analysing pixels to catch a retouch is a race you lose. The approach that works is the opposite: do not look for the edit — make it impossible to hide.
Read → -
Entropy and disguised files: reading bytes properly
A file has no will, but it has a character: the distribution of its bytes. Entropy measures that character in a number — and like every single number, it says something true and invites you to conclude too much.
Read → -
How to certify a web page as evidence: a practical guide
A post, a listing, a review: online, anything can be edited or deleted in seconds. Four ways to preserve a web page, what each one proves and how to do it in practice.
Read → -
Chain of custody for photographic evidence: what it is and why it matters
Chain of custody does not mean filling in a form. It means being able to show that between the event and the hearing, nobody could touch anything without leaving a trace.
Read → -
Signing with a smart card: PKCS#11 and remote signing
If the computer signs the document, does the private key end up in the computer's memory? No, and that is the entire reason smart cards exist. The key never leaves the card: it is the card that signs.
Read → -
WhatsApp as evidence in court: capturing the chat
Chats increasingly end up in litigation — separations, employment, debt, defamation. But a screenshot of the conversation is the easiest evidence to dispute. Here is how to capture a chat so it holds up.
Read →
Page 3 of 5 · 49 articles