4. Digital evidence 143. Digital evidence is information and data that are stored on, received from or transmitted by an electronic device. Digital evidence can be found in images on cameras, on the internet, computers, mobile phones and other digital media, such as USB sticks. 144. Digital evidence has become increasingly important in investigations. It can be recovered from a number of sources: open systems such as the internet and social media; and closed systems such as computers, laptops, mobile phones and cameras. Internet and mobile-phone service providers frequently keep their data (e.g. call records) for only a limited time. In planning an investigation, investigators should be aware of how long data is retained by these providers so they can ensure that the appropriate information is requested within the available time frame. 145. Digital information can be recorded in various formats: photographs, audio recordings, video recordings, email/network communications, text/sms messages, mobile phone applications and social media. All of this information can be useful to an investigator. The metadata (e.g. information on the creator, date of creation, device, location, alteration/changes) can provide valuable information. However, this metadata can also be easily manipulated. Authenticating digital evidence is a technical challenge. If digital evidence is considered to be important in an investigation, every effort should be made to ensure that a qualified forensic expert recovers and/or examines the evidence. 26 The Minnesota Protocol on the Investigation of Potentially Unlawful Death (2016) 5. Forensic accounting 146. Forensic accounting applies accounting, statistical and economic analysis to a criminal investigation. In the investigation of a suspicious death, it may uncover information that helps to identify a motive for a killing and possible suspects or witnesses. 6. Soil/environmental samples 147. When the crime scene involves an outdoor location, soil/environmental samples should be taken. Samples should be taken from the crime scene itself and also from the surrounding areas. These later samples provide control samples, allowing the forensic expert to determine background levels and weigh the importance of the evidence recovered from the crime scene. Samples should also be taken from alleged perpetrators’ clothing/footwear. Comparing the sample recovered at the crime scene with those samples recovered from the suspect could provide a link.