Dealing with Digital Evidence in Criminal Cases

Harewood Law have access to leading experts in the field of digital evidence across the UK, they are regularly instructed to challenge the prosecution narrative and to ensure context is given to the digital evidence that is presented before the court. We have regularly challenged prosecution digital experts who on occasions have been provided with limited extracted data which provides a helpful one-sided prosecution friendly picture. We ensure that the data reflects a true picture of what happened and ensures context is provided to a jury at trial.

The increasing prevalence of technology is evident in just about every walk of life. From being able to access information with one swipe of your finger to carrying out mundane, huge, or difficult tasks, technology has made our lives better and worse, depending on what side of the fence you sit on.

From a legal standpoint, evidence does not just come in physical form anymore. The advancement of computers, mobile phones, and the Internet has transformed the way evidence is gathered, allowing new lines of inquiry to be launched to secure convictions, defend victims, and release defendants who are wrongfully held.

Learn more about the way digital evidence is dealt with during criminal cases with our latest blog.

What is digital evidence?

Digital evidence is basically anything that can be used in a court of law or legal proceedings and investigations that originates from an electronic device. There are a number of steps that need to be taken for that digital evidence to be used properly, but sources of digital evidence may include:

• Communications - Text messages, WhatsApp messages, emails, social media posts, and chatrooms are examples of communicative digital evidence

• Cloud data - Online backups and Google Drive contain cloud accounts that have an abundance of data, which can be used as evidence

• Personal devices - Mobile phones, computers, tablets, and laptops can all possess sensitive material that can be deployed as vital evidence

• Web data - Location data is often included in mobile phones, while web history and IP addresses are other invaluable pieces of information that are digitally stored and can prove innocence or guilt

• Transactions - Any online accounts that detail transactions made over the Internet can be included as digital evidence

• Multimedia - Metadata is often stored on photos and videos that detail when and where a picture was taken, and this information can be retrieved from these devices for evidence

Initial steps for securing digital evidence

Here are the initial steps that have to be taken to make sure that evidence can be extracted digitally from a device or platform:

1. Secure the device - The physical item that contains the digital evidence needs to be properly treated as evidence in itself and kept on its own

2. Get the evidence - Images of the evidence and the original storage media need to be taken to provide copies of the evidence and maintain the integrity of the original device

3. Maintain the original - No direct work should take place on the device itself, so analysis should be conducted on images or copies of the device

4. Isolation - Ensure no automatic and remote deleting can take place, and keep it offline so that data cannot be altered

Ways of preserving digital evidence

The above steps are the initial ways of taking that digital evidence in the first place. But for it to be used properly, it needs to be preserved and stored in the right way; otherwise, it can be inadmissible in court. Cryptographic hashes are used on copied evidence so that they can be compared with the original in a way that ensures they are identical and not altered. Encryptions will also stop unwarranted parties from gaining access to important digital devices, while the device’s secure storage in an environmentally controlled facility helps to maintain the integrity of the media. Access logs and physically secure locations mean that contamination of the evidence cannot take place.

The importance of analysis and authentication

Trained digital experts need to look over and analyse the evidence - it is not enough to simply have it. It needs to be interpreted the right way by trained professionals who have many years of expertise in this field to rule out any doubts over information being doctored in any way. An audit trail should document anything that is done to a device in order to show accountability that work to preserve digital evidence has been done properly. And authentication is absolutely vital - without this, digital evidence is unlikely to be seen as permissible. Information such as metadata, code, and digital signatures shows in black and white when and where information was sent or received. An independent expert needs to verify this so that there is no confusion or doubt about how trustworthy a piece of evidence is.

Why digital evidence is considered volatile

There are a number of reasons why digital evidence may be seen as volatile:

• Ability to manipulate - Data can be quickly changed or deleted, overwriting the original message or information so that it disappears and cannot be then used as digital evidence

• Loss of power - If a device is powered off or restarted, some data can be lost, meaning its usefulness as evidence disappears

• Malware - Some software is designed to get rid of data through malicious code that is in the system’s memory

• Network connections - Information can be lost if it is not properly saved or if a network goes down during the middle of an important task, relinquishing that evidence indefinitely

• Temporary memory - Some information is stored on a temporary drive and is not included in a permanent storage device, meaning it can easily disappear

Using digital evidence in court

Digital evidence must be clear of jargon and obvious to everyone in the courtroom as to what it is. If people cannot understand what is being presented, it is unlikely that it can be used to properly ascertain what has happened. Simplified reports and timelines can help establish what the digital evidence is outlining, which can be a massive help in translating what a piece of digital evidence means. This evidence has to be relevant to the case, and its reliability and integrity have to be paramount and free from doubt. Bringing in experts to clearly define the digital evidence may be another way to highlight the importance of what the digital evidence says about a defendant or a victim.

Find an expert who uses digital evidence properly

There is no doubt that digital evidence is becoming more prevalent in modern court cases. This is why Harewood Law utilises the latest technology so that we can use digital evidence as we see fit. Digital evidence can be used to quash a conviction, to help put a defendant away, to help with an appeal, and for many other reasons. Contact our legal team today to discover more.