Digital Evidence

Digital forensics encompasses the activity of computers, networks, databases, cell phones, cell towers, digital cameras, GPS devices and other types of digital or electronic evidence. Issues to be considered may include search and seizure, preservation of data, privacy, acquisition, analysis of digital media, and the production of a report that can be used in court.

Digital

National Academy of Sciences Report - See pp. 179-182 for the National Research Counsel's evaluation of Digital and Multimedia Analysis.

Scientific Working Group on Digital Evidence - composed of member organizations that are actively engaged in the field of digital and multimedia evidence. Works to foster communication and cooperation and ensure quality and consistency within the forensic community.

Forensic Examination of Digital Evidence: A Guide for Law Enforcement, Electronic Crime Scene Investigation: An On-the-Scene Reference for First Responders, and Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors - these guides set out the National Institute of Justice's recommendations for how law enforcement and crime scene investigators should handle digital evidence. Evidence on cell phones or computers can be changed or destroyed if proper techniques are not used to forensically analyze the data. This guide may be used to cross examine law enforcement officers who did not follow the recommendations for handling this type of evidence.

Online Resources

  • Digital Forensics for Attorneys - a 60 minute on-demand School of Government virtual CLE by digital forensics expert Larry Daniel that provides an overview of digital forensic concepts, case examples, and relevant terminology. Attorneys will learn the basic information needed to understand the process of computer and cell phone forensics and the proper methods for search and seizure of electronic evidence. The presentation can be viewed for free or for CLE credit.
  • Getting Facebook into Evidence - this guide, prepared by Larry Daniel, provides information on the collection, preservation, and authentication of Facebook evidence from a digital forensics perspective.
  • Guide to Child Pornography Cases - Larry Daniel addresses common issues with child pornography cases in this guide. Topics include what information an expert will need and what services an expert may be able to provide. Daniel provides an explanation of technical terms commonly used in these cases.
  • Overcoming Hurdles in Digital Evidence - Attorney Howard Kurtz has posted information on his blog about how to view video evidence. This information may be useful for attorneys seeking to open videos from surveillance cameras, police departments, or other video evidence that is provided in a seemingly corrupt digital .avi format.
  • Subpoena Guide - this guide contains addresses and phone/fax numbers for the legal departments/subpoena compliance centers of cellular providers and social media sites. Please be aware of 2010 Formal Ethics Opinion 2 when issuing North Carolina subpoenas. Email Sarah Rackley Olson if you have any corrections or updated information.
  • UNC School of Government posts on digital evidence:
  • Online Directory - search this directory of wireless and internet service providers to find contact information for legal departments. This directory was created for law enforcement use through a grant from the DOJ. The website also contains several publications on digital evidence and investigating high-tech crimes. Some are available to the general public and others are available only to law enforcement.
  • Retention Periods of Major Cellular Service Providers - The Computer Crime and Intellectual Property Section of the U.S. Department of Justice gathered information about the retention periods for call details, cell tower information, text message content, pictures, and other types of data. This information has been posted online by the ACLU.
  • Social Media Law Enforcement Guides - the Electronic Frontier Foundation received a number of guides regarding information that is maintained by various social networking sites and how to request that information. The guides are posted on their website, under the "documents" tab, scroll down to Social Media Law Enforcement Guides.
  • Attorney Resource Center Online - Digital forensics expert Larry Daniel operates this site. If you register on the site, you can receive access to training materials and other resources. Mr. Daniel is the author of Digital Forensics for Legal Professionals: Understanding Digital Evidence From The Warrant To The Courtroom, published Sept. 2011. See his blog for commentary on current topics in digital forensics.
  • Computer Forensics for Dummies by Linda Volonino and Reynaldo Anzaldua - this book provides an excellent introduction to the topic. An overview of the materials is available in an online "cheat sheet."
  • Association of Digital Forensics, Security and Law - The ADFSL is a non-profit organization that supports the Journal of Digital Forensics, Security and Law, the Conference on Digital Forensics, Security and Law, and a listserve in support of the journal, the conference and other issues relating to digital forensics, security and law.

Digital Evidence Experts

For information about experts who have previously worked on cases involving digital evidence, see this online database.

Articles

From the National Association of Criminal Defense Lawyers:

From the University of North Carolina School of Government's Criminal Law Blog:

  • Georgia Case on Searching Cell Phones Incident to Arrest - Analysis of a recent decision by the Georgia Court of Appeals (Hawkins v. State) regarding searches of cell phone data incident to arrest.
  • Authentication and Hearsay Issues with Phone Records - This post considers whether hearsay and authentication objections can be overcome where the state seeks to introduce a defendant's phone records using an affidavit stating the phone records are business records.
  • Discovery in Child Pornography Cases - Discussion of the discovery process in child pornography cases and whether a copy of the defendant's hard drive may be provided so that a defense expert can analyze it.
  • Sexting - Inquires about the possibilities of criminal prosecution for sexting (sending pornographic digital images via text message) by minors.
  • Computer Searches and the Scope of Consent - Suggests a possible application of traditional notions of scope of consent in computer searches by law enforcement.
  • Encrypted Computer Files and the Fifth Amendment - Discusses the legal and technical challenges of accessing encrypted files on a suspect's computer, including consideration of the Fifth Amendment right against self-incrimination.
  • Warrantless Searches of Computers and Other Electronic Devices - Includes a link to a list of list of cases on subjects such as cell phones searches incident to arrest, whether a consensual search of a residence includes the computers there, and privacy expectations in laptop issued by an employer.
  • The Second Look Doctrine, Part I and Part II - This two-part post covers the "second look" doctrine, which holds that if the police looked at, or could have looked at an item, such as a cell phone, during the arrest and booking process and are still in possession of the item, they can take a second look at it later, without a warrant, without violating the Fourth Amendment. The first post explains the doctrine; the second addresses some issues of applying it, including whether there is a probable cause requirement.
  • Searching Cell Phones for Evidence of Texting While Driving - Examines the investigative authority of officers attempting to enforce laws against texting while driving.

Forensic Magazine regularly posts articles on digital forensics on its Digital Forensic Insider page. Recent topics include: SIM card forensics, cell phone evidence, and collecting computer evidence.

From the Electronic Frontier Foundation:

  • Cell Tracking - Considers whether the government can use cell phone records to track the physical location of a suspect without first obtaining a warrant based on probable cause.
  • Printers - Discusses the practice of color laser printer manufacturers encoding of identifying information on each page printed by the machine. Explores the privacy implications of this practice.
  • Revised Opinion in Privacy Case Blurs Clear Limits to Digital Search and Seizure - Discusses a 2010 Ninth Circuit case dealing with proper procedure for electronic searches.