A Digital Forensic Copy is not Simply Copying All Files From The Device (Legal Aspects)
ISSN
2683-5568
Date Issued
2026-02-19
Author(s)
Ss. Cyril and Methodius University, Iustinianus Primus Faculty of Law, Bul. Goce Delchev 9b, 1000 Skopje, Republic of North Macedonia
Rashkovska, Veronika
MIT University – Skopje, Faculty of Legal Sciences, International Relations and Diplomacy, Bul. Treta Makedonska brigade 66b, 1000 Skopje, Republic of North Macedonia
Abstract
The main idea of this paper is to delve deeper into the necessity of creating a digital forensic copy when collecting and securing digital evidence, the reason being that the non-creation thereof or creating it incorrectly will lead to further steps in the digital forensic procedure becoming pointless, and the digital evidence to be "Fruits of the poisonous tree"
Creating a digital forensic copy is the first step after the digital evidence arrives at the digital forensics lab. It should not only be so because the written procedures require it, but because the digital forensic copy is further the source of the digital evidence, and at the same time – the source remains unchanged.
The paper provides practical advice on what the parties in court proceedings (particularly in criminal proceedings) should pay attention to regarding the creation of the digital forensic copy. The first and original advice is that a forensic copy should be immediately made. There is no procedure that can justify not making a digital forensic copy, except for a on-site digital forensics expert on a war field.
The paper addresses one of the crucial questions that has been referred to very little so far, and many times it has been misinterpreted – is data extraction the same as making a digital forensic copy and why not?
One of the basic methods used in this paper is the comparative method and it will be used to explain the importance of the digital forensic copy procedure by comparing it with other medical, biological and physical procedures that are very commonly known and are part of people's everyday life, so that through such examples, a reader from any professional profile can get a visual representation of the justification of the main hypothesis.
Creating a digital forensic copy is the first step after the digital evidence arrives at the digital forensics lab. It should not only be so because the written procedures require it, but because the digital forensic copy is further the source of the digital evidence, and at the same time – the source remains unchanged.
The paper provides practical advice on what the parties in court proceedings (particularly in criminal proceedings) should pay attention to regarding the creation of the digital forensic copy. The first and original advice is that a forensic copy should be immediately made. There is no procedure that can justify not making a digital forensic copy, except for a on-site digital forensics expert on a war field.
The paper addresses one of the crucial questions that has been referred to very little so far, and many times it has been misinterpreted – is data extraction the same as making a digital forensic copy and why not?
One of the basic methods used in this paper is the comparative method and it will be used to explain the importance of the digital forensic copy procedure by comparing it with other medical, biological and physical procedures that are very commonly known and are part of people's everyday life, so that through such examples, a reader from any professional profile can get a visual representation of the justification of the main hypothesis.
File(s)![Thumbnail Image]()
Loading...
Name
A digital forensic copy is not simply copying all files from the device - Full paper - EN.docx
Size
39.27 KB
Format
Microsoft Word XML
Checksum
(MD5):ea0648ffe7bec65ccbb2b3c4577f7920