Digital documents are those that are created, stored, and transmitted through computer devices, such as computers, tablets, cell phones, and servers. They can be of various types and formats, such as texts, spreadsheets, images, videos, audios, emails, contracts, invoices, etc. Digital documents are increasingly used in personal, professional, and institutional activities, as they offer advantages…
However, digital documents are also subject to problems, doubts, or fraud that can affect their validity, integrity, and authenticity. For example, a digital document can be altered, copied, deleted, corrupted, or falsified by malicious individuals or due to technical failures. Furthermore, a digital document may be the subject of disputes or litigation between the parties involved in its creation or use.
In these cases, it is necessary to resort to digital forensics of digital documents, which is a specialized activity that aims to analyze and investigate the technical and legal aspects of digital documents, seeking to clarify their origin, authorship, content, and history of modifications. Digital forensics in digital documents can be performed by digital forensic experts or computer forensics experts, who are professionals trained to collect, preserve, examine, and present digital evidence in administrative, criminal, or judicial proceedings.
In this article, we will explain what digital forensics in digital documents is, who it is intended for, what methodologies and techniques are used by experts, and what the main issues related to the topic are.
What is digital forensics in digital documents?
Digital forensics in digital documents is an activity that consists of applying scientific and technical methods to analyze and investigate digital documents that are the subject of interest or controversy in a specific situation. The objective of digital forensics in digital documents is to verify the existence, authenticity, integrity, and timeliness of digital documents, as well as to identify their origin, authorship, and content.
It is a procedure that can be performed on both born-digital documents and scanned documents. Born-digital documents are those that are generated and maintained exclusively in digital form, without physical correspondence. For example: an electronically signed contract. Digitized documents are those that originate in physical form and are subsequently converted to digital format through a digitization process. For example: a scanned invoice.
This type of service should be requested by individuals or legal entities that have an interest in or involvement with the analyzed digital documents. For example: the contracting parties of a digital document; the victims or defendants of a crime involving a digital document; public or private bodies that need to verify the conformity of a digital document; judges or lawyers who need to base their decisions or arguments on a digital document.
Regarding its execution, digital forensics of digital documents can be carried out judicially or extrajudicially. Judicial forensics is that which is determined by a judge within the scope of a judicial process. In this case, the expert is appointed by the judge and must follow the current procedural rules. Extrajudicial forensics is that which is contracted by one of the interested parties outside the context of a judicial process. In this case, the expert is chosen by the contracting party and must follow the best practices of the area.
Forensic Methodology for Conducting Expert Analysis
With a forensic methodology based on four main steps, the methodology for digital document analysis consists of: collection, preservation, examination, and presentation of digital evidence.
Collection
Identify and obtain the computer devices containing the digital documents to be analyzed. Collection must be done carefully and meticulously to avoid damage or alteration to the original data. Collection can be done on-site (at the location where the devices are) or remotely (through network access).
Preservation
Protect and maintain the collected data unaltered throughout the analysis process. Preservation must guarantee the chain of custody of digital evidence, that is, the record of all persons who had access to the data and all actions performed on them. Preservation can be done through techniques such as forensic copying (which makes a faithful replica of the data), sealing (which prevents unauthorized access to the data), and encryption (which encodes the data to prevent its improper reading).
Examination
Analyze the preserved data to extract the information relevant to the expert analysis. The examination should be based on questions formulated by the interested parties or the judge (call
