Part 1 - The Dynamics of Digital Evidence
| Site: | OpenLearn Create |
| Course: | Digital Detectives: Understanding Communication in Digital Forensic Evidence |
| Book: | Part 1 - The Dynamics of Digital Evidence |
| Printed by: | Guest user |
| Date: | Thursday, 10 September 2026, 9:09 PM |
1. The Dynamics of Digital Evidence
The Journey of Digital Forensic Evidence
Summary of our Research Methods
Before we follow the evidence through the Clarusia case, it is worth briefly explaining where the ideas in this module come from.
The Clarus project studied digital forensic and investigative practice across five partner countries: Scotland, Greece, Czechia, Portugal, and Finland.
This research involved a daily diary with forensic practitioners. This enabled the research team to capture the everyday work of forensic practitioners and their communication and interaction with others.
In addition, interviews, focus groups and a survey with people with different roles and responsibilities in investigation teams across the different countries have helped researchers understand how processes for handling digital forensic evidence operate in practice and identify where miscommunication and bias in the investigation process may become a risk.
The research has allowed researchers to build both static and dynamic models of digital forensic and investigative work based on the practical reality of how people ask for clarification, solve problems, explain evidence and adapt to urgent situations.
A static model shows the main roles and structures in the system.
A dynamic model follows the journey of digital devices and evidence through different stages of an investigation.
Dynamic Model:
OPTIONAL LEARNING: Read more about the research work using diaries.
Move to the next page by clicking the arrow on the top right to move to the next page in this section.
2. How do investigations work in practice?
The different methods used by the Clarus project give researchers a fuller and more realistic picture of how digital evidence is handled in real working environments.
The policing and forensic systems across Europe are shaped by rules, but also by habits, pressures, relationships, expertise, and communication. In other words, if we want to understand the journey of digital evidence, we need to look at both the formal workflow and the human practices that support it.
Formal protocols and operating procedures are designed and well-placed to safeguard the authenticity and integrity of evidence and minimise biases in all national systems.
International standards and best-practice frameworks emphasise the importance of impartiality, documentation, confidentiality, and evidence integrity in forensic practice. For example, ISO/IEC 17020 sets requirements for the competence and impartiality of inspection bodies, while ISO/IEC 27037 and ISO/IEC 27043 provide guidance specifically for the handling and investigation of digital evidence.
OPTIONAL LEARNING: Read more about the policy changes the Clarus project has suggested based on the research work.
Move to the next page by clicking the arrow on the top right to move to the next page in this section.
3. Activity 2: The Lifecycle of Digital Evidence – From Collection to Courtroom
Digital Detectives: A Murder in Clarusia
In Module A, you were introduced to Digital Detectives: Murders in Clarusia. We will now begin following the investigation itself.
The story takes place in Clarusia, a fictional European city. As the investigation unfolds, you will see different professionals become involved and follow evidence as it begins its journey through the criminal justice system.
Read pages 6–11: A Murder in Clarusia.
For now, simply follow the story and pay attention to what happens at the scene and during the early stages of the investigation.
As you read, think about:
- What potential evidence do you notice?
- Who becomes involved in the investigation?
- What happens to the evidence after it is discovered?
- Where do you see information being passed from one person or team to another?
Don't worry about identifying everything. We will return to what you have just seen throughout this module as we explore how digital evidence is identified, collected, examined and communicated.
As the story continues, we begin to see the practical side of handling digital evidence. The phone is found, photographed in situ, handled under pressure, and then bagged and documented. The scene also shows something very important: the evidence is already beginning to move through a chain of people, decisions, and communications. It is no longer just an object lying in the bushes. It is now part of a workflow.
Digital Evidence Can Come from Many Sources
Digital evidence is not limited to one obvious item. In many cases, useful information may come from several different devices, systems or sources, some of which can be easy to overlook if attention is focused too narrowly.
In the Clarusia scenario, the mobile phone found in the bushes is the most obvious object that may contain digital evidence. However, investigators may also need to consider what other sources of digital information could be relevant.
For example, depending on what is available in the surrounding area, this might include CCTV footage, smartwatches or other wearable devices, dashcams in nearby vehicles, or communications and location data associated with mobile networks.
Different sources can provide different pieces of the picture, such as locations, communications, images, timings or connections between people and places. What is considered relevant may also change as an investigation develops and new questions emerge.
This is one reason why clear communication and shared understanding are so important. The people involved need to understand what information is being sought, what different sources may be able to provide, and why particular evidence may be relevant at that stage of the investigation.
Move to the next page by clicking the arrow on the top right to move to the next page in this section.
4. Ideal Types Verus Real Practise
Decision-Making at the Crime Scene: Ideal Types and Real Practice
This is the end of Module B Part 1. From the drop-down menu on the left of the screen, select Module B Part 2.