As the use of computers, mobile phones and the internet permeates nearly every area of our lives, digital evidence has the potential to stretch far beyond computer-based crimes.

The recent jailing of Portuguese lorry driver Paulo Jorge Nogueira da Silva on six counts of causing death by dangerous driving highlights the important role digital forensics can play in criminal litigation. Computer Forensics analysis of a laptop in the vehicle suggested that Mr Nogueira da Silva had failed to pay attention to the road for at least a minute prior to the incident, with this evidence playing an important part in the trial that followed.

Now consider a hypothetical situation in which a fraudulent claim has been made for grant funding. The recovery of web logs might allow prosecutors to establish that a logo used on the invoice was acquired via a web search, while registry files might identify the user and the time the document was created. Similarly, a recovered Google search for a specific drug which was subsequently found within the victim might be inextricably linked to the suspect and could therefore provide evidence supporting their prosecution and conviction in a murder case.

Identifying sources of evidence

So how do litigators identify whether digital forensics can provide relevant evidence for a particular case? Establishing where evidence might lie requires a 360-degree view of the situation, considering both the direct and indirect ways in which digital technology could play a part in a particular crime. This could range from its outright use, such as the use of computers for viewing indecent images or less obviously, identifying an alibi, through the placing of a phone call to another party at the time of the crime, for example.

All digital devices have the potential to provide evidence for a case, so it is often worth involving a computer forensic expert at an early stage, so that they can work with you to establish sources of potential evidence.

Working with digital evidence

When beginning work with a computer forensics expert, in addition to passing over the device for analysis, litigators should expect to provide clear instructions in relation to the case. This includes the background to the case, such as a copy of the indictment, defence case statement, counsel’s advice if available and any previous reports relating to digital evidence in the exhibit, again where available. Experts will also need a clear remit and as tight a brief as possible with information such as times and date ranges, keywords, names, phone numbers and locations. This information will assist the digital analyst to extract evidence relevant to the case (if and where available) in most criminal cases.

In order to avoid contamination of evidence, careful consideration should be given to the device acquisition and handling process. It is vital to remember that digital evidence is extremely volatile. If handled incorrectly, it may be regarded as unreliable and subsequently discounted; It is therefore advisable to secure the exhibit in a safe place as early as possible in a secure location where it cannot be interfered with.

Indeed, a full documentation of the continuity of exhibits and the transfer of seal numbers from the initial seizer of the evidence to its final handler must be carefully maintained. An exhibit which is switched on by untrained personnel could result in the state of the digital evidence being altered, thus rendering it unusable as evidence for prosecution or defence. This example highlights the necessity for anyone who encounters the evidence to take extreme care, prior to passing the exhibit to a professional forensic expert, to ensure that they do not damage its validity.

Similarly, once under forensic conditions, the original exhibit (e.g. the suspect’s computer) will never be examined itself; instead, an exact copy, or ‘image’, of the drive is made by analysts and the original device returned to the police property store. Evidence deriving from the examination of the copy is then produced as new or additional evidence. It is worth noting that all materials relating to the case uncovered by the prosecution must be disclosed to the defence team, whereas the defence team has no such requirement to share any information it deems to be unhelpful with the prosecution.

Limitations of digital evidence

Defence teams are sometimes limited by the budget imposed by the Legal Services Commission, which is determined by the proportionality of the request. In cases where digital evidence is required for non-computer based crimes, the proportionality of the request may be queried and where digital investigation is speculative, it can often be difficult to justify the need for such evidence to be gathered.

Often, litigators may choose to address this issue by commissioning investigation of digital devices only after all other avenues have been exhausted. While this can potentially avoid unnecessary digital investigation, it can mean that inadequate time is left for an investigator to return their findings in time for trial. This is another reason why it is worthwhile to involve an expert in an advisory capacity at an early stage, so that the deadline for choosing to progress with an investigation can be factored in. A forensic practitioner will also be able to advise on the most practical and economic forensic strategy; for example, a case involving multiple computers, may not require full analysis of all the machines. Instead, forensic investigators can ‘preview’ the images of all the computers, but only undertake full analysis of one which clearly offers the evidence being sought.

Presenting digital evidence at trial

When presenting digital evidence in court, the digital forensics expert should also be able to act as witness in order to explaining their findings and give testimony in terms of opinion as well as fact. However, aside from this obvious role in the courtroom, the expert can also provide support in a number of other ways. They can guide the legislator through arguments, both for and against specific conclusions and act as a consultant to develop relevant and proportionate questions to direct at opposing forensic experts. It is also common for one expert to be called upon to validate the findings of other experts during the prosecution process. In short, the expert assists the litigator in all aspects which have a digital component relating to the case.