In this digital age, most business is conducted electronically. This contemporary paradigm creates openings for potentially harmful unanticipated information security incidents of both a criminal or civil nature, with the potential to cause considerable direct and indirect damage to smaller businesses. Electronic evidence is fundamental to the successful handling of such incidents. If an organisation does not prepare proactively for such incidents it is highly likely that important relevant digital evidence will not be available. Not being able to respond effectively could be extremely damaging to smaller companies, as they are unable to absorb losses as easily as larger organisations. In order to prepare smaller businesses for incidents of this nature, the implementation of Digital Forensic Readiness policies and procedures is necessitated. Numerous varying factors such as the perceived high cost, as well as the current lack of forensic skills, make the implementation of Digital Forensic Readiness appear difficult if not infeasible for smaller organisations. In order to solve this problem it is necessary to develop a scalable and flexible framework for the implementation of DigitalForensic Readiness based on the individual risk profile of a small to medium enterprise (SME). This paper aims to determine, from literature, the concepts of Digital Forensic Readiness and how they apply to SMEs. Based on the findings, the aspects of Digital Forensics and organisational characteristics that should be included in such a framework is highlighted..

No abstract

MD5 and SHA-1 cryptographic hash algorithms are a standard practice in digital forensics that is used in the preservation of digital evidence and ensuring the integrity of the digital evidence. Recent studies have shown that both MD5 and SHA-1 have vulnerabilities and collisions. Based on this, the use of MD5 and SHA-1 hash algorithms in the practice of digital forensics to preserve and ensure the integrity of digital evidence has been questioned in certain instances. Using experimentation, the researcher proves the validity of using either MD5 or SHA-1 hashing algorithms to ensure the integrity of seized digital evidence, from the moment of seizure of the evidence, through to eventual presentation and use of the evidence in court; thus demonstrating that the use of hashing remains a valid forensic methodology to ensure the integrity of digital evidence.

In most legal systems, it is crucial that evidence that is obtained for use in any judicial proceedings, especially criminal prosecutions, is obtained lawfully. In other words, no crimes should be committed in the obtaining and examining of any evidence, which will be later, be relied upon in court.Section 86 of the Electronic Communications and Transactions Act 25 of 2002 in South Africa creates a criminal offence of unauthorized access to data, which has a significant potential impact on the acquisition, examination, and analysis of digital evidence; in that traditional digital forensic processes, unless legally authorized, may potentially be in contravention of this law.The legal ramifications for both digital forensics practitioners and the cases that they are engaged on are identified, and appropriate legal solutions are provided to ensure that digital forensic practitioners do not contravene the existing legislation.

Criminal investigations and the resulting criminal prosecutions are dependent on quality evidence to ensure convictions. With the increasing number of digital devices in our society, a significant amount of evidence is digital, and the discipline of digital forensics, as a forensic science, should ensure the validity of this digital evidence in court. As a forensic science, quality assurance is crucial in the practice of digital forensics, to assure the court that the evidence can be trusted. The research explored the current state of digital forensic quality assurance in the criminal justice system in South Africa to determine what quality assurance practices were used, to identify any problems, as well as possible causes of any shortcomings. The research identified significant deficiencies with regard to quality assurance in digital forensics, and identified areas that potentially could impact negatively in the court environment if contested. In summary, the general state of quality assurance practice in digital forensics was poor. Reasons identified for this included a lack of training in digital forensic science fundamentals, lack of training in quality assurance in digital forensics, high case loads, and poor supervision.