可否變動數位證據：現場存取原始證物的省思

Can we work from the original data and change the digital evidence at crime scene?

執法機關經常處於快速變動的工作環境，在調查案件中需要分析數位資料，提供關鍵證據。數位鑑識科學利用科學方法識別、收集、獲取及保存數位證據，2001年數位鑑識研究研討會律定「不可存取原始證物，只可檢查備份」原則，對整體執法環境而言是危險的。該原則忽略執法機關現場第一線調查人員需要獲取快速、立即、可用情資的實際需要。本文回顧數位鑑識調查「存取原始證物之變動數位證據」的相關文獻，討論犯罪現場取證的相關活動意涵，再就由區別現場調查及實驗室鑑識的差異，提出一個新的數位證據的證物治理策略，改善整體執法調查程序。

Law enforcement agencies work in an area of constant change, need to analyze digital data, and supply vital evidence in all investigations. Digital forensic science provides scientifically proven methods that can be used to identify, collect, acquire and preserve digital evidence. Setting an absolute standard that dictates 'work from an exact copy of the original data' is dangerous from the 2001 first Digital Forensic Research Workshop in a legal context. It has ignored the urgent need for first responders to find actionable intelligence immediately at crime scene. This study reviews some former arguments on this evidence dynamics of accessing the original data for digital forensic investigation, and aims at the relevant activities at crime scene. The results illustrate the difference between scene investigation and lab forensics, and propose a new digital evidence governance strategy to improve the whole investigation process.