Digital evidence is everywhere. We have seen an explosion in the everyday use of digital devices in recent years. Everything from computers or laptops to memory cards, DVDs, sat-navs and online websites can contain critical digital evidence. Furthermore, fragments of deleted information that can be located and reconstructed may be the key to evaluating the evidence in the case. Our Digital Experts are forensic scientists who use specialist techniques to safely examine digital storage media and devices whilst maintaining the original evidence in line with ACPO guidelines, thereby ensuring their findings are suitable for presentation in criminal, civil, or other court proceedings. As the field has progressed, the older terms Computer Forensics, Cyber Forensics, Digital Evidence Recovery and Internet Forensics have generally been assimilated under the heading of Digital Forensics.
It is critical to distinguish between the mere existence of files or images and evaluative evidence that serves to reliably establish their provenance. For example, assessing the likely source of such material and whether the evidence supports an assertion that the defendant was deliberately seeking the charged material, or if it was inadvertently accessed. It is also important to analyse the relevant witness statements to assess whether alternative explanations may be possible, such as another user of the computer being responsible for the presence of the material. We also comment upon whether malware such as viruses or remote access to the computer is consistent with the evidence.
Our Computer and Digital Experts’ caseload is not restricted, however, to criminal law. In the business arena intellectual property theft, data leakage, industrial espionage and potentially bogus tribunal claims are just some of the areas in which our investigative, analytical and technical skills and experience have been exceptionally effective. It is also of note that a professional examination of digital material may be necessary in the exercising of “due diligence”, where such must be shown.
Each year our highly experienced experts undertake dozens of computer examinations for all types of offences, even those not traditionally associated with computer evidence. Examples include:
We can verify the classification of such images against the SGC scale (sometimes erroneously referred to as the “Oliver Scale” or the “Copine Scale”) and draw attention to any case law that may be relevant to the charges. Establishing how the images came to be on the computer, what search terms were used, and who may have been responsible is our speciality. This has become an even greater priority since the prosecuting authorities have started to commence proceedings on “triage” evidence, which does not consider the provenance of the digital evidence.
If you are a CrimeLine subscriber, you can find our IIOC podcast HERE.
Conversations on platforms such as Facebook, Skype, Twitter, and Windows Live Messenger can often provide crucial evidence in supporting or debunking the statement of a witness, defendant, or complainant. We can log in to your client’s Facebook account and exhibit such messages ready for Court. Alternatively, if the messages have been deleted, we can examine the computers of all involved parties to recover the conversation.
A very significant proportion of crimes, specifically “white collar crime” and those related to classified drugs now have an online element. In addition to social media and instant messaging conversations, recovery of deleted emails can provide a clear overview of communications between individuals, and may be able to demonstrate a suspect’s involvement in a crime, or ignorance of the act.
Restrictions on what people can do online are becoming more common, including those imposed under restraining orders, sex offender orders and anti-terrorism controls. We can examine the relevant computers and report as to whether, and if so under what circumstances, such restrictions may have been breached. We discuss wider IP address evidence issues in a CrimeLine podcast HERE.
It is a fact of the modern world that loyalty to an employer is no longer seen as a virtue by some sections of the workforce. Couple this with the straightened financial circumstances of the last few years, and the offer by a competitor of a financial inducement to steal company-confidential data may prove too much of a temptation.
It is also an unfortunately common occurrence for a departing employee to take sensitive data with them when they leave. We have the facility to screen digital equipment, particularly laptops and memory devices, used by the employee for any indications of potential data leakage. If we find such evidence, we can discuss the options with you.
Our Computer and Digital Experts use exactly the same methodologies in such cases as we do in high profile criminal cases. If the evidence is there, we will find it and present it in a form suitable for use in disciplinary proceedings or litigation.
Our commitment to you is to provide an accurate, complete and unbiased report in plain English. If it is necessary to use technical terms, then these will be explained. Often, when subjected to expert scrutiny, evidence that initially appears to be convincing or even overwhelming may be shown to be incomplete or misinterpreted. We promise to deliver much more than a simple “data dump” of what was present. As further reassurance, you will also have direct access to the examining expert to discuss their findings, which is of particular benefit in a complex case.
