Digital devices are in our pockets, we use them in every facet of our lives. They know us on an intimate level – what interests us, what we buy, what we are thinking about, our health, our habits, our relationships, where we go – it is all there.
What can they testify to in court?
How can we look at them as an expert witness? We propose a paradigm shift for legal counsel – a new way of thinking that will help attorneys free themselves from the disruption of trying to find individual, relevant, documents amidst a sea of literally millions of documents and files stored on numerous electronic devices.
We invite you to think differently about electronically stored information (ESI) and digital forensics that links electronic evidence and its use in discovery to the way attorneys often prepare to assist a client. If you can accept that digital devices have key evidence and are therefore key witnesses (i.e. they can tell us who knew what, when did they know it, and what did they do), then preserving and using these devices is no more complicated than using the testimony of a witness that speaks a foreign language. You may need a translator, such as Key Forensics, to understand the testimony—but the device itself can certainly tell a story that can be the key to winning your case.
Devices as Witnesses?
Personal devices contain electronic evidence associated with the behavior of their owners and other devices in their environment, which can help clarify the facts of a case. These devices are usually analyzed as containers of proof. However, it is possible to harness the plethora of personal devices to advance the concept of digital witnesses, where personal devices can actively acquire, store, and transmit digital evidence reliably and securely. The data is managed, and specialized technologies can be used to extract it with security guarantees. Special software systems, such as Cellebrite, Oxygen Forensics and EnCase (all of which Key Forensics utilizes) can be utilized to quickly obtain the necessary data (or evidence) in a legally sound and thorough way.
The Document Abyss
Searching for documents in an electronic world is a trap. When faced with a duty to preserve electronic information, one becomes overwhelmed because they perceive the duty to preserve requires that they identify each relevant electronic document. It is often believed they must rely upon the client and/or key players to identify relevant information; hoping the client can defend the protocols, the data is not changed during the preservation process, and that they understand the scope of discoverable information. Moreover, the terms and concepts used by IT professionals can be very confusing and the sheer volume of data can be overwhelming. It is also often believed that strategic use of electronic evidence is only possible and necessary in very large cases or to obtain settlement to avoid discovery.
Relevant Evidence
Devices have two characteristics that make them act like a human witness:
They contain electronic memory and they process/create information on their own. Its memory allows it to store information, like a human witness. In this regard, they are “fact” witnesses, capable of being searched to produce the relevant electronic documents created by key players.
Their processing capability allows them to also be an “event witness” – recording the way they were used. This information is created by the file or operating system and installed applications.
Why Use a Professional Agency?
Data collections are a key component in your case. Do it wrong and the evidence can be thrown out, the key metadata can be altered and irreversible and potentially destroy your case. Ensuring clients are satisfying their disclosure requirements, as well as making sure opposing parties or third parties are preserving relevant documents is crucial to success. Common items such as internet history, deleted text messages, phone apps and social media all play a large part in a litigation case, but it must be collected in a forensically sound manner or you risk it being deemed inadmissible.
When data is not collected in a forensically sound manner, you inherently change the metadata, whether you mean to or not. Once opposing counsel objects because of spoiled metadata, it is out, and sanctions and/or summary judgment on your case can be right around the corner.
Data collections should be done by an independent third party, such as Key Forensics. Making sure the data is collected correctly is KEY to finding and using deleted data in your case.
Potential issues that could arise from improper collection of data include:
When not done by a certified, trained digital forensic examiner, it is typically NOT done correctly, and is often copied and pasted and saved on a thumb drive. This is not a good idea, and may not be defensible in court.
If an organization, or a member of the organization’s IT staff collected the data, the argument can be made that there is bias. Opposing counsel would have reason to believe a KEY piece of evidence could have (and probably has) been left out. The solution is to outsource, moving the liability to a professional, such as ourselves.
Most people do not realize what is capable of being collected and typically miss KEY pieces of data that could serve as evidence.
Certified digital forensic examiners, such as myself, can:
explain technical concepts and present mass amounts of data in a clear and understandable manner with respect to electronic evidence
demonstrate the securely collected and preserved data as electronic evidence (thus, presenting the digital device as a witness)
make sure the proper software is used, as only a few software programs have been tested and approved by various courts as forensically sound and reliable
assure that accepted procedures are employed, including documenting the chain of custody of electronic data
assure overall ability to testify and demonstrate the procedures employed are forensically sound
be aware of the ethics of my profession and laws governing my testimony
withstand cross-examination
Treating digital devices as witnesses naturally causes attorneys to identify those devices used by clients as potential sources of discoverable information—not because the attorney has identified any particular documents on the device; but rather because the client used the device. This is a fundamental shift in thinking that will naturally prevent attorneys from getting lost trying to find individual, relevant, documents amidst a sea of millions of documents stored on electronic devices. At the initial stages of using electronic evidence, it is advantageous for attorneys to identify digital devices as electronic witnesses because they have been used by the client or key player…and this skill does not require any technical training. You can leave the technical part to us!
Comments