Digital Evidence Management Plan

Abstract

The degree of the reliability, integrity, and availability of information in organizations can determine the credibility of the organization. As people and applications generate information, the information is stored in various places. It is vital for the organization to know where information is stored, what format it is, and how to access it. Not all information will be evidence but it is essential that organizations identify potential evidence proactively. Good evidence is a business enabler. Organizations require ‘good’ evidence to demonstrate due diligence with respect to good corporate and IT governance and to investigate and manage internal and external incidents. All internal and external forensic investigations hinge on ‘good’ evidence. Evidence in itself is not absolute, but is valuable when used to establish the truth about a particular incident. The paper will define digital evidence, propose a theoretical Evidence Management Plan (EMP), and briefly discuss potential benefits and constraints of the implementation of the proposed EMP.