The Path of Digital Evidence in Digital Forensics Activities, a Review

Abstract

Computer forensics is the discipline that deals with the identification, acquisition, analysis and preservation of digital evidence, contributing to the ascertainment of facts in the legal sphere. Originally created to support criminal investigations, it has gradually been extended to civil, administrative and tax proceedings, following the increasing digitisation of society. The delicacy of computer evidence, characterised by volatility and the risk of alteration, requires rigorous methodologies to guarantee its integrity, authenticity and admissibility in court. The Italian legal system introduced the discipline of computer forensics with law no. 547/1993, and then conformed to international standards with the ratification of the Budapest Convention of 2001 (law no. 48/2008), which outlined the guidelines for the management of digital evidence and the chain of custody. Despite the absence of unambiguous operational regulations in Italy, the scientific community adopts protocols inspired by international standards such as RFC3227. A central role in investigations is played by mobile devices, in particular smartphones, which constitute real digital archives of personal data and communications. The evolution of artificial intelligence and data science is providing new opportunities for analysis and investigation, but increasingly sophisticated cyber threats complicate the work of forensic experts. In the current context of digital investigations, critical issues emerge that concern not only the technical aspects, but also the transparency and accessibility of operations, especially in the phases of evidence acquisition and preservation. The marginal involvement of the forensic specialist raises questions about the balance between investigative needs and epistemological guarantees.