Streaming media expert witnesses may opine on digital multimedia evidence and streaming video, as well as related topics. The Law Enforcement & Emergency Services Video Association (LEVA) issued their Best Practices for the Acquisition of Digital Multimedia Evidence Version 3.0 on April 14, 2010, including information on preservation of DME.
DME preservation should consider the following:
Gaining Physical Access If the data is stored on-site, coordinate with personnel at the storage location to gain access to secured areas, locked containers, or storage devices.
Access to remotely stored evidence may be acquired over network cables, phone cables, or through wireless connectivity. It may be necessary to contact other personnel who can access the DME and make arrangements to preserve the data.Gaining Logical Access Usernames and passwords may be required to gain logical access to the data on the system. Local network information, such as IP addresses, may also be required.
Controlling Access Controlling access to the system can be accomplished by limiting physical access to the recording/storage device and by isolating the recording/storage device from external sources. External sources of access include network cables, phone cables, and wireless communication devices.
Preventing Loss Steps should be taken to ensure no overwriting of the relevant data occurs until the data has been transferred to the acquisition media. Attention should be given to pre-scheduled data-purge and/or over-write settings. It may be necessary to solicit the assistance of additional resources including, but not limited to, manufacturer support personnel, network administrators, or a qualified computer forensic examiner. A sudden loss of power could cause destruction of the evidence. Terminating the power source should be considered a last resort.
Read more: leva.org.
LEVA Disclaimer:
As a condition to the use of this document and the information contained therein, the LEVA requests notification by e-mail before or contemporaneous to the introduction of this document, or any portion thereof, as a marked exhibit offered for or moved into evidence in any judicial, administrative, legislative or adjudicatory hearing or other proceeding (including discovery proceedings). Such notification shall include:
1) The formal name of the proceeding, including docket number or similar identifier;
2) The name and location of the body conducting the hearing or proceeding;
3) The subsequent to the use of this document in a formal proceeding please notify LEVA as to its use and outcome; and
4) The name, mailing address (if available) and contact information of the party offering or moving the document into evidence.
Notifications should be sent to documentation@leva.org. It is the user’s responsibility to ensure they have the most current version of this document. It is recommended that previous versions be archived for future reference, as needed, in accordance with that agency’s policies.
Redistribution Policy:
LEVA grants permission for redistribution and use of all publicly posted documents provided that the following conditions are met:
1) Redistributions of documents or parts of documents must retain the LEVA cover page containing the disclaimer.
2) Neither the name of LEVA nor the names of contributors may be used to endorse or promote products derived from its documents.
3) Any reference or quote from a LEVA document must include the version number (or create date) of the document and mention if the document is in a draft status.