Table 4

Potential Sources of Digital Evidence for Evaluations

Internal and external computer hard drives
Digital archives and/or backup disks and drives
Media storage devices, such as zip drives, USB flash drives, CD-Rs, and DVD-Rs
Archives maintained by ISPs or stored on networks
Cached Web browser files and/or logs of Web browser activity, including search terms used on search engine sites (e.g., how to make MDMA (methamphetamine)); lists of URLs visited with the dates and times of access
Hidden files or files “deleted but not gone”71,72; any available information on documents that may have been destroyed
Archived e-mails and chat logs; records of e-mail discussion groups such as Usenet; messages stored or accessed through newsgroup reader software
Websites, including personal homepages, blogs, profiles on social networking sites, and bulletin boards or other Web-based discussion groups
Cell phone/smart phone records of calls and text messages, videos, and images
Personal and work computers; cookies, malware, or applications stored on the evaluee's computer
Material stored on hand-held personal digital assistants (PDAs) or other portable electronic devices