Part 1 - The Dynamics of Digital Evidence
3. Activity 2: The Lifecycle of Digital Evidence – From Collection to Courtroom
Digital Detectives: A Murder in Clarusia
In Module A, you were introduced to Digital Detectives: Murders in Clarusia. We will now begin following the investigation itself.
The story takes place in Clarusia, a fictional European city. As the investigation unfolds, you will see different professionals become involved and follow evidence as it begins its journey through the criminal justice system.
Read pages 6–11: A Murder in Clarusia.
For now, simply follow the story and pay attention to what happens at the scene and during the early stages of the investigation.
As you read, think about:
- What potential evidence do you notice?
- Who becomes involved in the investigation?
- What happens to the evidence after it is discovered?
- Where do you see information being passed from one person or team to another?
Don't worry about identifying everything. We will return to what you have just seen throughout this module as we explore how digital evidence is identified, collected, examined and communicated.
As the story continues, we begin to see the practical side of handling digital evidence. The phone is found, photographed in situ, handled under pressure, and then bagged and documented. The scene also shows something very important: the evidence is already beginning to move through a chain of people, decisions, and communications. It is no longer just an object lying in the bushes. It is now part of a workflow.
Digital Evidence Can Come from Many Sources
Digital evidence is not limited to one obvious item. In many cases, useful information may come from several different devices, systems or sources, some of which can be easy to overlook if attention is focused too narrowly.
In the Clarusia scenario, the mobile phone found in the bushes is the most obvious object that may contain digital evidence. However, investigators may also need to consider what other sources of digital information could be relevant.
For example, depending on what is available in the surrounding area, this might include CCTV footage, smartwatches or other wearable devices, dashcams in nearby vehicles, or communications and location data associated with mobile networks.
Different sources can provide different pieces of the picture, such as locations, communications, images, timings or connections between people and places. What is considered relevant may also change as an investigation develops and new questions emerge.
This is one reason why clear communication and shared understanding are so important. The people involved need to understand what information is being sought, what different sources may be able to provide, and why particular evidence may be relevant at that stage of the investigation.
Move to the next page by clicking the arrow on the top right to move to the next page in this section.