Digital forensics encompasses the activity of computers, networks, databases, cell phones, cell towers, digital cameras, GPS devices and other types of digital or electronic evidence. Issues to be considered may include search and seizure, preservation of data, privacy, acquisition, analysis of digital media, and the production of a report that can be used in court.
National Academy of Sciences Report - See pp. 179-182 for the National Research Counsel's evaluation of Digital and Multimedia Analysis.
Scientific Working Group on Digital Evidence - composed of member organizations that are actively engaged in the field of digital and multimedia evidence. Works to foster communication and cooperation and ensure quality and consistency within the forensic community.
Forensic Examination of Digital Evidence: A Guide for Law Enforcement, Electronic Crime Scene Investigation: An On-the-Scene Reference for First Responders, and Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors - these guides set out the National Institute of Justice's recommendations for how law enforcement and crime scene investigators should handle digital evidence. Evidence on cell phones or computers can be changed or destroyed if proper techniques are not used to forensically analyze the data. This guide may be used to cross examine law enforcement officers who did not follow the recommendations for handling this type of evidence.
- Digital Forensics for Attorneys - a 60 minute on-demand School of Government virtual CLE by digital forensics expert Larry Daniel that provides an overview of digital forensic concepts, case examples, and relevant terminology. Attorneys will learn the basic information needed to understand the process of computer and cell phone forensics and the proper methods for search and seizure of electronic evidence. The presentation can be viewed for free or for CLE credit.
- Getting Facebook into Evidence - this guide, prepared by Larry Daniel, provides information on the collection, preservation, and authentication of Facebook evidence from a digital forensics perspective.
- Guide to Child Pornography Cases - Larry Daniel addresses common issues with child pornography cases in this guide. Topics include what information an expert will need and what services an expert may be able to provide. Daniel provides an explanation of technical terms commonly used in these cases.
- Overcoming Hurdles in Digital Evidence - Attorney Howard Kurtz has posted information on his blog about how to view video evidence. This information may be useful for attorneys seeking to open videos from surveillance cameras, police departments, or other video evidence that is provided in a seemingly corrupt digital .avi format.
- Subpoena Guide - this guide contains addresses and phone/fax numbers for the legal departments/subpoena compliance centers of cellular providers and social media sites. Please be aware of 2010 Formal Ethics Opinion 2 when issuing North Carolina subpoenas. Email Sarah Rackley Olson if you have any corrections or updated information.
- UNC School of Government posts on digital evidence:
- Computer Searches and Plain View - Nov. 21, 2013 post by Jeff Welty
- Returns and Inventories for Computer Search Warrants - Nov. 19, 2013 post by Jeff Welty, provides information on requirements for returns and inventories for computer search warrants.
- Testimony about Tracking - Oct. 22, 2013 post by Jeff Welty, provides an overview of case law on testimony regarding GPS tracking and cell tower tracking.
- Shea Denning's October 2012 North Carolina Criminal Law blog post, State v. Wilkerson and the Authentication of Electronic Evidence, provides an overview of North Carolina case law on the authentication of text messages.
- Online Directory - search this directory of wireless and internet service providers to find contact information for legal departments. This directory was created for law enforcement use through a grant from the DOJ. The website also contains several publications on digital evidence and investigating high-tech crimes. Some are available to the general public and others are available only to law enforcement.
- Retention Periods of Major Cellular Service Providers - The Computer Crime and Intellectual Property Section of the U.S. Department of Justice gathered information about the retention periods for call details, cell tower information, text message content, pictures, and other types of data. This information has been posted online by the ACLU.
- Social Media Law Enforcement Guides - the Electronic Frontier Foundation received a number of guides regarding information that is maintained by various social networking sites and how to request that information. The guides are posted on their website, under the "documents" tab, scroll down to Social Media Law Enforcement Guides.
- Attorney Resource Center Online - Digital forensics expert Larry Daniel operates this site. If you register on the site, you can receive access to training materials and other resources. Mr. Daniel is the author of Digital Forensics for Legal Professionals: Understanding Digital Evidence From The Warrant To The Courtroom, published Sept. 2011. See his blog for commentary on current topics in digital forensics.
- Computer Forensics for Dummies by Linda Volonino and Reynaldo Anzaldua - this book provides an excellent introduction to the topic. An overview of the materials is available in an online "cheat sheet."
- Association of Digital Forensics, Security and Law - The ADFSL is a non-profit organization that supports the Journal of Digital Forensics, Security and Law, the Conference on Digital Forensics, Security and Law, and a listserve in support of the journal, the conference and other issues relating to digital forensics, security and law.
Digital Evidence Experts
For information about experts who have previously worked on cases involving digital evidence, see this online database.
- Recent news articles - this page contains links to recent press coverage of local and national cases involving digital evidence and is updated regularly.
- Prosecutors’ use of mobile phone tracking is ‘junk science,’ critics say - this article in the June 2013 ABA Journal describes a case where a U.S. District Court judge excluded cell tower evidence, finding that the government had not demonstrated that testimony on the subject was reliable.
- The Limitations and Admissibility of Using Historical Cellular Site Data to Track the Location of a Cellular Phone by Aaron Blank, XVIII RICH. J.L. & TECH. 3 (2011). Discusses how a cellular network works, how a cell phone tracks its location, limitations on cell site data as a tracking method, admissibility of cell site data, and constitutional implications for seizure of cell site data. Provides practical suggestions concerning admission and exclusion of this evidence.
- Expanding the Potential for GPS Evidence Acquisition - this article looks at how GPS data is collected, the devices used, and some potential limitations to this technology.
- Reasons to Challenge Digital Evidence and Electronic Photography by Michael Cherry, July 2003 - Digital photographic evidence is less reliable than its traditional film counterpart for several reasons. Read more to learn how an investigator's inadequate forensic training can lead the introduction of significant errors and what questions to ask when evaluating the accuracy of digital images submitted as evidence.
- The Plain View Doctrine and Computer Searches: Balancing Law Enforcement's Investigatory Needs with Privacy Rights in the Digital Age by David H. Angeli and Christina Schuck, Aug 2010 - This article discusses constitutional issues related to searching a suspect's computer and suggests forensic techniques and resources to assist in navigate this challenge.
- An Approach to Cell Phone Evidence for Criminal Defense Attorneys by Daniel K. Gelb, Nov. 2009 - Electronic evidence from a defendant's cell phone use is becoming increasingly important in criminal cases. This article guides counsel in obtaining and accessing cell phone evidence and includes discussion of constitutional, statutory, and regulatory considerations.
- Computer Forensics: How to Obtain and Analyze Electronic Evidence by Wade Davies, June 2003 - This article gives essential tips for working with digital evidence obtained from a the computer of a defendant, including recommendations for and limitations of collaborating with computer evidence experts, discovery issues unique to digital evidence, and the importance of obtaining access to the original evidence rather than copies.
- Georgia Case on Searching Cell Phones Incident to Arrest - Analysis of a recent decision by the Georgia Court of Appeals (Hawkins v. State) regarding searches of cell phone data incident to arrest.
- Authentication and Hearsay Issues with Phone Records - This post considers whether hearsay and authentication objections can be overcome where the state seeks to introduce a defendant's phone records using an affidavit stating the phone records are business records.
- Discovery in Child Pornography Cases - Discussion of the discovery process in child pornography cases and whether a copy of the defendant's hard drive may be provided so that a defense expert can analyze it.
- Sexting - Inquires about the possibilities of criminal prosecution for sexting (sending pornographic digital images via text message) by minors.
- Computer Searches and the Scope of Consent - Suggests a possible application of traditional notions of scope of consent in computer searches by law enforcement.
- Encrypted Computer Files and the Fifth Amendment - Discusses the legal and technical challenges of accessing encrypted files on a suspect's computer, including consideration of the Fifth Amendment right against self-incrimination.
- Warrantless Searches of Computers and Other Electronic Devices - Includes a link to a list of list of cases on subjects such as cell phones searches incident to arrest, whether a consensual search of a residence includes the computers there, and privacy expectations in laptop issued by an employer.
- The Second Look Doctrine, Part I and Part II - This two-part post covers the "second look" doctrine, which holds that if the police looked at, or could have looked at an item, such as a cell phone, during the arrest and booking process and are still in possession of the item, they can take a second look at it later, without a warrant, without violating the Fourth Amendment. The first post explains the doctrine; the second addresses some issues of applying it, including whether there is a probable cause requirement.
- Searching Cell Phones for Evidence of Texting While Driving - Examines the investigative authority of officers attempting to enforce laws against texting while driving.
Forensic Magazine regularly posts articles on digital forensics on its Digital Forensic Insider page. Recent topics include: SIM card forensics, cell phone evidence, and collecting computer evidence.
From the Electronic Frontier Foundation:
- Cell Tracking - Considers whether the government can use cell phone records to track the physical location of a suspect without first obtaining a warrant based on probable cause.
- Printers - Discusses the practice of color laser printer manufacturers encoding of identifying information on each page printed by the machine. Explores the privacy implications of this practice.
- Revised Opinion in Privacy Case Blurs Clear Limits to Digital Search and Seizure - Discusses a 2010 Ninth Circuit case dealing with proper procedure for electronic searches.