The Power of Digital Evidence in Forensic Investigations

Digital evidence has many applications in the field of forensics, from detecting criminal activity such as fraud to identifying child victims of abuse. Digital devices as a whole have become part of everyday life, and as such, this type of evidence is becoming increasingly common in the prosecution and defence of serious crime.

Perpetrators of the most heinous of crimes such as terror attacks, drug deals and child abuse are becoming increasingly reliant on computers and other digital devices to communicate and organise their activities. We caught up with Christine Hall, former Technical Manager at IntaForensics, to discuss how this complex evidence type can be used to help build a robust case.

 

How would you define digital forensics?

“Digital forensics is the recovery, analysis and reporting of data from any device capable of storing digital data - from computers and mobiles to drones, smart watches and TVs.

“While a lot of the time it is focused on preserving evidence, it isn’t reserved solely for criminal case work. The skills and processes involved in digital forensics can also be used commercially, for example to support internal investigations or to recover someone’s personal photographs from a corrupted memory card.”

 

When and how is digital forensics used?

“Digital forensics can be used in a multitude of cases. In criminal cases, for example, it can be used to detect fraud, to identify the cause of a cyber-attack and even to help place a device in a specific location at a particular date and time.

“I have worked on a case where I was able to show that the device user had downloaded images from the internet of Rolex watches and created eBay adverts using these images to sell watches. Once the payment had been received, the user would close their eBay account and create a new one repeating the process. A physical watch was never sent to any customers.”

 

How contestable is digital evidence?

“It depends on the evidence that is being submitted. There are usually two experts on a case, one instructed by the prosecution and one by the defence. When both experts agree that the facts are technically correct or supported, digital evidence is rarely contested, but would often need explaining in court.

“This is because the facts are usually technically correct, meaning there’s rarely any grounds to contest upon as the evidence is either present or not present. Contested evidence normally appears when an expert provides their opinion on the series of events. For example, this would be the case if two experts do not agree that the technical findings show intent, or disagree on whether an image meets the criteria to be deemed illegal.”

 

What cannot be recovered?

“What can and can’t be recovered is dependent on many factors, such as the software that’s available at the time, the experience of the examiner, potential encryption and the functionality of the device.

“Mobile device software is updated regularly and support for makes and models increases the number of devices from which data can be extracted and decoded for forensic analysis.”

“As our understanding of the data improves, the quantity of data that can be decoded from a device increases.  Take a Samsung 6 device that was obtained in 2018, for example. At the time, 100 messages were decoded.

“However, the same extraction could be repeated in 2021 using the latest version of the software, and by this point 120 messages could be decoded. As software and tools advance in sophistication, analysts can interpret data more effectively, and recover messages that they were not able to decode before.”

 

What are the limitations of digital evidence?

“In most cases, we can’t place a person physically in front of a device. We can show what account was logged in to and what activity took place, but from that evidence alone we cannot prove who was physically using the device at the time. Because of this, digital evidence relies upon corroboration, supporting information such as CCTV, who had access to the device, knowledge of passwords and eye-witness accounts.”

 

How has digital evidence evolved over time?

“Advances in technology have played a huge part in how digital evidence has evolved. This includes much larger dataset sizes, increased use of mobile devices, cloud storage, and smart devices.

“In addition to this, the changing educational landscape has played a part too. The fact that there are now university degrees in digital forensics and that cybersecurity is now often mixed with digital forensics means that we’re able to conduct multi-disciplinary investigations and focus on multiple aspects within a digital evidence case.”

 

What’s the difference in digital evidence use between civil and criminal law?

“For criminal investigations, technical findings are reported using Streamlined Forensic Reporting (SFR) or MG11 witness statements. This data needs to be considered reliable and relevant for it to be admissible before use in court. It also requires the burden of proof to be beyond all reasonable doubt.

“While civil cases do not necessarily require the same level of exhibit handling, we treat all cases as if they are criminal. This is so that if a civil matter progresses to a criminal investigation, we already have the bases covered. The burden of proof for a civil matter is based upon the balance of probability.”

 

What are some case examples within which digital evidence has been utilised?

“We worked on a particular case on behalf of a council. This was a benefit fraud case where an individual was suspected of illegally claiming around £60,000 in disability benefits.

“We obtained and examined the computer belonging to the suspect. We identified evidence of the suspect searching for and ordering cruise tickets, while also finding holiday videos from the cruise showing the suspect singing, dancing and swimming. After informing the client about what we discovered, we were then told that around the time of the cruise, the suspect would attend interviews with a walking stick and a portable oxygen tank. The videos were crucial in showing that fraud had taken place.”

“We see a variety of exhibits pass through the imaging department, but perhaps the most interesting aspect is the creative ways people manage to conceal cameras.

“We have had cameras hidden within deodorant cans and air fresheners, as well as one which arrived to us partly assembled, which was being used for voyeuristic purposes.

“These devices are often home-made and vary in quality, but they constantly remind you how easy it is to build simple devices which can be concealed and used to non-consensually spy on people.”

 

Digital Forensics Expertise

Forensic Access boasts a world-class team of forensic scientists operating in custom built facilities. All forensic work is carried-out to the highest Quality Standards.

All defence work is handled by dedicated Casework Managers who provide end-to-end support and streamlining. Direct access to our team of scientists helps barristers and solicitors to prepare a more effective defence strategy, and all expert witness reports are thoroughly documented and peer reviewed.

To find out more about our forensic services, Tel: 01235 605293 to speak with a member of our casework team or fill-in our online contact form.