|Author:||Aswami Fadillah Mohd Ariffin/Izwan Iskandar Ishak|
|Position::||Head of Digital Forensic, CyberSecurity Malaysia/Senior Executive, Strategic Policy & Legal Research of CyberSecurity|
Introduction. Digital forensics evidence: the legal framework. Opinion of experts in Malaysia. Cybersecurity Malaysia: its role in digital forensics. Expert witness: the completion of the perfect cycle. CyberSecurity Malaysia: the focal point in digital forensics. The future.
Introduction The term digital forensics is still relatively new to Malaysia, even though our digital forensic analysts have appeared as an expert witness in several high profile cases. More awareness and promotion programmes have to be devised in order to educate the public, and in particular those in the legal communities. Overall, digital forensics are one tool in helping to solve crimes, especially when crimes involves the use of computers or any digital devices such as mobile telephones or PDAs (it can be computer crime or computer related crime). Data stored in such devices may be recovered and presented as evidence in court. The accused may, for example, try to delete any data stored in their computer with the intention of destroying evidence and avoiding successful prosecution. However, with digital forensic technology, any data that has been deleted may still be recovered. This certainly will help the court in adjudicating the case presented. Digital forensics evidence: the legal framework As a general rule, evidence is admissible if it is lawfully admitted at trial. At the time of writing this paper, the Malaysian Evidence Act 1950 only deals with the admissibility of documents produced by computers and of the statement contained in the document.1 A new provision, S90A is an exception to the hearsay rule, and provides that a document produced by a computer or a statement contain therein shall be admissible as evidence of any fact stated in the document whether or not the person tendering the same is the maker of such document or statement.2 Section 90A of the Malaysian Evidence Act 1950 provides as follows: 90A. Admissibility of documents produced by computers and of statements, contained therein. (1) In any criminal or civil proceeding a document produced by a computer or a statement contained in such document, shall be admissible as evidence of any fact stated therein if the document was produced by the computer in the course of its ordinary use, whether or not the person tendering the same is the maker of such document or statement. (2) For the purposes of this section it may be proved that a document was produced by a computer in the course of its ordinary use by tendering to the court a certificate signed by a person who either before or after the production of the document by the computer is responsible for the management of the operation of that computer, or for the conduct of the activities for which that computer was used. (3) (a) It shall be sufficient, in a certificate given under subsection (2), for a matter to be stated to the best of the knowledge and belief of the person stating it. (b) A certificate given under subsection (2) shall be admissible in evidence as prima facie proof of all matters stated in it without proof of signature of the person who gave the certificate. (4) Where a certificate is given under subsection (2), it shall be presumed that the computer referred to in the certificate was in good working order and was operating properly in all respects throughout the material part of the period during which the document was produced. (5) A document shall be deemed to have been produced by a computer whether it was produced by it directly or by means of any appropriate equipment, and whether or not there was any direct or indirect human intervention. (6) A document produced by a computer, or a statement contained in such document, shall be admissible in evidence whether or not it was produced by the computer after the commencement of the criminal or civil proceeding or after the commencement of any investigation or inquiry, in relation to the criminal or civil proceeding or such investigation or inquiry, and any document so produced by a computer shall be deemed to be produced by the computer in the course of its ordinary use. (7) Notwithstanding anything contained in this section, a document produced by a computer, or a statement...
To continue reading
REQUEST YOUR FREE TRIAL