The eye-witness system has three functions: proof, supervision and auxiliary discovery. At present,
aiming at the practical demand of electronic data forensics, the Ministry of Public Security has formulated the
rules of electronic data forensics on the basis of the characteristics of electronic data——multilayer, systematicness
and relative stability, which provides guidance for the collection of electronic data in the investigation stage.
Throughout the establishment of the eye-witness system in the process of electronic data forensics, there are
some problems, for example, the logical conflict in application of rules of electronic data forensics, the failure of
application of the eye-witness system due to the unclear boundary of forensics measures, and the obstruction in
application of eye-witness system caused by the unclear nature of some forensics behaviors and so on. Therefore,
we should refer to the traditional investigation measures and combine with the new characteristics of electronic
data, to explore the reasonable standard of establishment of eye-witness system in electronic data forensics. And
on this basis, we try to put forward solutions to the problems about the establishment of eye-witness system, to
realize the value of eye-witness system in electronic data forensics.