Seizure of digital data and “selective suppression” of digital evidence

Abstract

The search and gathering of potential digital evidence often includes taking images of hard-drives and other storage media. Instead of actually taking the physical hard-drive, only the data contained on the drive is mirrored, stored and then used for investigations. This article discusses the legal context in Germany and in the U.S. and compares the actual legal situation with the current practice based on the available software products for forensic evaluations. In spite of large differences between both countries, the investigation shows that in both cases current technology needs to be improved or even is in contradiction with basic laws. The proposed solution can provide a suitable implementation without changing the actual process of evaluating the digital evidence. For investigations in Germany, the new process proposes a selective partial deletion of images, thus removing all inadmissible data. For the U.S. the process proposes a selective suppression of data so that it can be recovered if a case is appealed.