Method and apparatus for controlling digital evidence

Abstract

A method and apparatus for controlling digital evidence comprising creating a case record comprising information about an investigative case, electronically storing at least one piece of digital evidence into memory, and associating the stored at least one piece of evidence with the case record.

1 . A method for controlling digital evidence, comprising:
 creating a case record comprising information about an investigative case;   electronically storing at least one piece of digital evidence in memory; and   associating the stored at least one piece of evidence with the case record.   
   
   
       2 . The method of  claim 1  wherein the electronically storing the at least one piece of evidence further comprises creating a clone of the at least one piece of evidence. 
   
   
       3 . The method of  claim 2  wherein the creating a clone step further comprises generating a hash of the clone and the at least one piece of evidence. 
   
   
       4 . The method of  claim 3  wherein the hash is an MD5 hash. 
   
   
       5 . The method of  claim 1  wherein the case record is created in a relational database. 
   
   
       6 . The method of  claim 1  wherein the electronically storing the at least one piece of evidence further comprises creating an image of the at least one piece of evidence. 
   
   
       7 . The method of  claim 1  further comprising establishing roles for each person in a plurality of persons that are able to access the case record, where each role defines a level of access. 
   
   
       8 . The method of  claim 1  further comprising creating a unique identifier for the at least one piece of evidence. 
   
   
       9 . The method of  claim 1  wherein the at least one piece of evidence is at least one of contents of a digital media, a log file and a network dump. 
   
   
       10 . The method of  claim 1  further comprising uploading photographic evidence to the case record. 
   
   
       11 . The method of  claim 1  further comprising creating a timeline within the case record comprising a sequence of events that occurred during an investigation involving the at least one piece of evidence. 
   
   
       12 . The method of  claim 1  further comprising creating a chain of custody within the case record comprising identification of persons that have accessed the case record and interacted with the at least one piece of evidence. 
   
   
       13 . The method of  claim 1  further comprising storing cost information in the case record. 
   
   
       14 . The method of  claim 1  further comprising selectably creating at least one report regarding the case record. 
   
   
       15 . Apparatus for controlling at least one piece of digital evidence, comprising:
 a computer for establishing a case record within a database, where the case record comprises at least one piece of digital evidence and case information;   a memory, coupled to the computer, for storing the case record; and   at least one client workstation, coupled to the computer, for allowing the case record to be accessed during an investigation.   
   
   
       16 . The apparatus of  claim 15  wherein the computer creates a clone or image of the at least one piece of digital evidence. 
   
   
       17 . The apparatus of  claim 15  wherein the at least one piece of digital evidence is at least one of contents of a digital media, a log file and a network dump. 
   
   
       18 . A computer readable medium comprising software that, when executed by a processor, causes the processor to perform a method comprising:
 creating a case record comprising information about an investigative case;   electronically storing at least one piece of digital evidence on a digital media; and   associating the stored at least one piece of evidence with the case record.   
   
   
       19 . The computer readable medium of  claim 18  wherein the electronically storing step further comprises creating either a clone or an image of the at least one piece of digital evidence. 
   
   
       20 . The computer readable medium of  claim 18  further comprising tracking access to the case record.