Hearsay is an out-of-court statement offered to prove the truth of the matter asserted. Under the U.S. Federal Rules of Evidence (FRE), hearsay is generally not admissible unless it falls under a specific exception.
In digital forensics, hearsay becomes relevant when digital evidence contains human assertions. If a person wrote or said something, and that statement is being offered to prove it is true, it may be hearsay.
Examples of digital evidence that may be hearsay:
- A personal letter
- A memo
- Bookkeeping records
- Records of business transactions input by a person
However, computer-generated records produced by an automated process with no human assertion are generally not hearsay. Because no person is making a statement through the data, the hearsay rule does not apply.
Examples of non-hearsay automated records:
- GPS tracking records
- ATM PIN entry logs
- Dialed phone number records
- Network logs generated automatically by systems
The U.S. Department of Justice notes that courts sometimes mistakenly classify computer-generated records as hearsay when they are not. In some cases, digital evidence has been admitted under the Business Records exception to the hearsay rule.
Source: Network Forensics: Tracking Hackers through Cyberspace, §1.3.5.