As digital devices continue to embed themselves in modern life, the amount of evidence that can be gleaned from them grows at an alarming rate. Commonplace is digital evidence from mobile phones, tablets and computers, but useful evidence is emerging from the cloud, vehicle infotainment systems, vehicle trackers, drones that store or relay location data, and ‘the internet of things’ which can include evidence from a doorbell or smoke detector.
When instructing an expert in these areas, there are certain preparations you can make to simplify getting the help you need.
- Understanding which expert you need
It may be worth a quick call to see what expert you need. A mobile phone case might need two different experts – one to look at cell site records and one to look at the download of messages from the mobile phone. A collision investigation report might require a digital expert to interpret GPS data and a Road Traffic Accident (RTA) expert to consider data from a black box recorder.
- Limitations of the evidence
A mobile phone is not a computer. It is relatively straightforward to make a verifiable, entire, exact copy of a computer hard drive, for analysis.
With mobile phones, a download may not be a copy of everything that is on the phone. How an examination proceeds can vary, depending on the issues, but may include re-examination of the phone with different software or using specialist equipment to remove data directly from the chip on the circuit board. Not all of the material on the phone is necessarily captured and it is critical to know what the question is in order to target the analysis.
Cell site evidence has a number of shared limitations, the most significant being that it can never pinpoint a mobile phone, only tell you the general area it was in at a given time. Be wary of any claims of a person being in a specific place based on cell site evidence. Furthermore, be aware that any cell site evidence referring to “data” records or “GPRS” have to be interpreted differently to texts and calls and, if wrongly interpreted, can give misleading information.
One of the biggest challenges is timeframes. Good digital experts have calendars filled up for weeks in advance. Coming to an expert two weeks before a trial with material the Crown spent six months putting together is unlikely to lead to a useful independent review unless you have very specific issues in mind.
In this regard, focussing instructions will go a long way to ensure you find an expert available to get the work done in time. Examples that can make a big differences include narrowing down the number of phones to consider, reducing the range of dates to look at, or limiting the quantity or type of images to search for.
- Having the material available
Often getting digital evidence in a form the expert can use can take weeks of toing and froing with CPS or Police, despite the fact the Crown’s expert has been able to use these materials to prepare their reports. Examples are:
- Being given reports from forensic software as opposed to a copy of the raw data
- Not being provided with all of the material as it is “sensitive”
- Being provided with a PDF version of call data records and not original Excel spreadsheets of the data
- Being provided with Excel spreadsheets of data that have been manipulated by the Police into a different format, sometimes resulting in loss of data
- Getting PDF images that are low resolution copies rather than copies of the original JPEG images
The way forward:
If you expect to be instructing a digital forensic expert, it is worth asking early on in the case what material the expert is likely to need so that, when approval to proceed comes in, they are already in a good place to start.
The experts at Keith Borer Consultants are happy to guide you on what materials and timescales are required and also consider alternative ways of addressing the issues in the case. For example, with high volume cases (tens or hundreds of thousands of messages or images), we may be able to assist in narrowing the issues or finding ways to review such a volume in a reasonable time. We can also look at bespoke solutions which may be critical when comparing the information in a witness account with how an app or system might have behaved in those circumstances.
Dr David Schudel, Senior Manager, Keith Borer Consultants
For more information, please contact Dr David Schudel on 0191 332 4999 or email firstname.lastname@example.org.