Digital evidence
Encyclopedia
Digital evidence or electronic evidence is any probative
information stored or transmitted in digital
form that a party to a court case may use at trial
. Before accepting digital evidence a court will determine if the evidence is relevant, whether it is authentic, if it is hearsay and whether a copy is acceptable or the original is required.
The use of digital evidence has increased in the past few decades as courts have allowed the use of e-mail
s, digital photograph
s, ATM transaction logs, word processing
documents, instant message histories, files saved from accounting programs, spreadsheets, internet browser histories, database
s, the contents of computer memory
, computer backup
s, computer printouts
, Global Positioning System
tracks, logs from a hotel’s electronic door locks, and digital video
or audio
files.
Many court
s in the United States
have applied the Federal Rules of Evidence
to digital evidence in a similar way to traditional documents, although some have noted important differences. For example, that digital evidence tends to be more voluminous, more difficult to destroy, easily modified, easily duplicated, potentially more expressive, and more readily available. As such, some courts have sometimes treated digital evidence differently for purposes of authentication
, hearsay
, the best evidence rule
, and privilege
. In December 2006, strict new rules were enacted within the Federal Rules of Civil Procedure
requiring the preservation and disclosure of electronically stored evidence. Digital evidence is often attacked for its authenticity due to the ease with which it can be modified, although courts are beginning to reject this argument without proof of tampering.
by courts because it was obtained without authorization. In most jurisdictions a warrant
is required to seize and investigate
digital devices. In a digital investigation this can present problems where, for example, evidence of other crimes are identified while investigating another. During a 1999 investigation into online harassment
by Keith Schroeder investigators found pornographic images of children on his computer. A second warrant had to be obtained before the evidence could be used to charge Schroeder.
, the proponent of digital evidence must lay the proper foundation. Courts largely concerned themselves with the reliability of such digital evidence. As such, early court decisions required that authentication called "for a more comprehensive foundation." US v. Scholle, 553 F.2d 1109 (8th Cir. 1976). As courts became more familiar with digital documents, they backed away from the higher standard and have since held that "computer data compilations… should be treated as any other record." US v. Vela, 673 F.2d 86, 90 (5th Cir. 1982).
A common attack on digital evidence is that digital media can be easily altered. However, in 2002 a US court ruled that "the fact that it is possible to alter data contained in a computer is plainly insufficient to establish untrustworthiness" (US v. Bonallo, 858 F. 2d 1427 - 1988 - Court of Appeals, 9th).
Nevertheless, the "more comprehensive" foundation required by Scholle remains good practice. The American Law Reports
lists a number ways to establish the comprehensive foundation. It suggests that the proponent demonstrate "the reliability of the computer equipment", "the manner in which the basic data was initially entered", "the measures taken to insure the accuracy of the data as entered", "the method of storing the data and the precautions taken to prevent its loss", "the reliability of the computer programs used to process the data", and "the measures taken to verify the accuracy of the program". 7 American Law Reports 4th, 8, 2b.
(ACPO) for the authentication and integrity of evidence. The guidelines consist of four principles:
These guidelines are widely accepted in courts of England and Scotland, but they do not constitute a legal requirement and their use is voluntary.
". However, the "Federal Rules of Evidence" rule 1001(3) states "if data are stored in a computer…, any printout or other output readable by sight, shown to reflect the data accurately, is an ‘original.’"
Commonly courts do not bar printouts under the best evidence rule. In Aguimatang v. California State Lottery
, the court gave near per se treatment to the admissibility of digital evidence stating "the computer printout does not violate the best evidence rule, because a computer printout is considered an ‘original.’" 234 Cal. App. 3d 769, 798.
. Like documentary evidence
, not all digital evidence is hearsay.
First, there is some digital evidence which is not hearsay at all. Hearsay is a "statement, other than one made by the declarant while testifying at the trial… offered in evidence to prove the truth of the matter asserted." A declarant is a person. Therefore, courts have held that digital evidence is not hearsay when it is "the by-product of a machine operation which uses for its input ‘statements’ entered into the machine" and was "was generated solely by the electrical and mechanical operations of the computer and telephone equipment." State v. Armstead, 432 So.2d 837, 839 (La. 1983).
Moreover, where the evidence is not offered to prove the truth of the statements, digital evidence is not hearsay. This is the case, for example, with logs of chatroom conversations. While a chatroom log may contain many out of court statements, which would otherwise be hearsay, they may be used for other purposes, including as a party admission
. US v. Simpson, 152 F.3s 1241 (10th Cir. 1998).
Second, hearsay recognizes a number of exceptions. Most frequently, proponents of digital evidence seek admission under the business records exception
. This perhaps is because the definition of business records includes a "data compilation." FRE
803(6). However, obviously not every piece of digital evidence is a business record. Such reliance on the business records exception has had bad results for its proponents. In Monotype Corp. PLC v. International Typeface Corp, the plaintiff
s relied on the business records exception to attempt to admit two e-mails as evidence that the defendants had infringed their copyright only to have it excluded by the court. 43 F.3d 443 (9th Cir. 1994). The court noted that the e-mail was not created "in the regular course of [the third party’s] business."
Other proponents have had success with the public records exception, excited utterance
, Present sense impression
, and the FRE 807—the catch-all. Where digital evidence does not meet one of the other exceptions but has "equivalent circumstantial guarantees of trustworthiness" that hearsay seeks to protect against, a court may apply the catch-all.
United States of America:
Relevance (law)
Relevance, in the common law of evidence, is the tendency of a given item of evidence to prove or disprove one of the legal elements of the case, or to have probative value to make one of the elements of the case likelier or not. Probative is a term used in law to signify "tending to prove."...
information stored or transmitted in digital
Digital
A digital system is a data technology that uses discrete values. By contrast, non-digital systems use a continuous range of values to represent information...
form that a party to a court case may use at trial
Trial (law)
In law, a trial is when parties to a dispute come together to present information in a tribunal, a formal setting with the authority to adjudicate claims or disputes. One form of tribunal is a court...
. Before accepting digital evidence a court will determine if the evidence is relevant, whether it is authentic, if it is hearsay and whether a copy is acceptable or the original is required.
The use of digital evidence has increased in the past few decades as courts have allowed the use of e-mail
E-mail
Electronic mail, commonly known as email or e-mail, is a method of exchanging digital messages from an author to one or more recipients. Modern email operates across the Internet or other computer networks. Some early email systems required that the author and the recipient both be online at the...
s, digital photograph
Digital photography
Digital photography is a form of photography that uses an array of light sensitive sensors to capture the image focused by the lens, as opposed to an exposure on light sensitive film...
s, ATM transaction logs, word processing
Word processing
Word processing is the creation of documents using a word processor. It can also refer to advanced shorthand techniques, sometimes used in specialized contexts with a specially modified typewriter.-External links:...
documents, instant message histories, files saved from accounting programs, spreadsheets, internet browser histories, database
Database
A database is an organized collection of data for one or more purposes, usually in digital form. The data are typically organized to model relevant aspects of reality , in a way that supports processes requiring this information...
s, the contents of computer memory
Computer memory
In computing, memory refers to the physical devices used to store programs or data on a temporary or permanent basis for use in a computer or other digital electronic device. The term primary memory is used for the information in physical systems which are fast In computing, memory refers to the...
, computer backup
Backup
In information technology, a backup or the process of backing up is making copies of data which may be used to restore the original after a data loss event. The verb form is back up in two words, whereas the noun is backup....
s, computer printouts
Computer printer
In computing, a printer is a peripheral which produces a text or graphics of documents stored in electronic form, usually on physical print media such as paper or transparencies. Many printers are primarily used as local peripherals, and are attached by a printer cable or, in most new printers, a...
, Global Positioning System
Global Positioning System
The Global Positioning System is a space-based global navigation satellite system that provides location and time information in all weather, anywhere on or near the Earth, where there is an unobstructed line of sight to four or more GPS satellites...
tracks, logs from a hotel’s electronic door locks, and digital video
Digital video
Digital video is a type of digital recording system that works by using a digital rather than an analog video signal.The terms camera, video camera, and camcorder are used interchangeably in this article.- History :...
or audio
Sound
Sound is a mechanical wave that is an oscillation of pressure transmitted through a solid, liquid, or gas, composed of frequencies within the range of hearing and of a level sufficiently strong to be heard, or the sensation stimulated in organs of hearing by such vibrations.-Propagation of...
files.
Many court
Court
A court is a form of tribunal, often a governmental institution, with the authority to adjudicate legal disputes between parties and carry out the administration of justice in civil, criminal, and administrative matters in accordance with the rule of law...
s in the United States
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
have applied the Federal Rules of Evidence
Federal Rules of Evidence
The is a code of evidence law governing the admission of facts by which parties in the United States federal court system may prove their cases, both civil and criminal. The Rules were enacted in 1975, with subsequent amendments....
to digital evidence in a similar way to traditional documents, although some have noted important differences. For example, that digital evidence tends to be more voluminous, more difficult to destroy, easily modified, easily duplicated, potentially more expressive, and more readily available. As such, some courts have sometimes treated digital evidence differently for purposes of authentication
Authentication
Authentication is the act of confirming the truth of an attribute of a datum or entity...
, hearsay
Hearsay
Hearsay is information gathered by one person from another person concerning some event, condition, or thing of which the first person had no direct experience. When submitted as evidence, such statements are called hearsay evidence. As a legal term, "hearsay" can also have the narrower meaning of...
, the best evidence rule
Best evidence rule
The best evidence rule is a common law rule of evidence which can be traced back at least as far as the 18th century. In Omychund v Barker 1 Atk, 21, 49; 26 ER 15, 33, Lord Harwicke stated that no evidence was admissible unless it was "the best that the nature of the case will allow"...
, and privilege
Privilege
A privilege is a special entitlement to immunity granted by the state or another authority to a restricted group, either by birth or on a conditional basis. It can be revoked in certain circumstances. In modern democratic states, a privilege is conditional and granted only after birth...
. In December 2006, strict new rules were enacted within the Federal Rules of Civil Procedure
Federal Rules of Civil Procedure
The Federal Rules of Civil Procedure govern civil procedure in United States district courts. The FRCP are promulgated by the United States Supreme Court pursuant to the Rules Enabling Act, and then the United States Congress has 7 months to veto the rules promulgated or they become part of the...
requiring the preservation and disclosure of electronically stored evidence. Digital evidence is often attacked for its authenticity due to the ease with which it can be modified, although courts are beginning to reject this argument without proof of tampering.
Admissibility
Digital evidence is often ruled inadmissibleAdmissible evidence
Admissible evidence, in a court of law, is any testimonial, documentary, or tangible evidence that may be introduced to a factfinder—usually a judge or jury—in order to establish or to bolster a point put forth by a party to the proceeding...
by courts because it was obtained without authorization. In most jurisdictions a warrant
Warrant (law)
Most often, the term warrant refers to a specific type of authorization; a writ issued by a competent officer, usually a judge or magistrate, which permits an otherwise illegal act that would violate individual rights and affords the person executing the writ protection from damages if the act is...
is required to seize and investigate
Search and seizure
Search and seizure is a legal procedure used in many civil law and common law legal systems whereby police or other authorities and their agents, who suspect that a crime has been committed, do a search of a person's property and confiscate any relevant evidence to the crime.Some countries have...
digital devices. In a digital investigation this can present problems where, for example, evidence of other crimes are identified while investigating another. During a 1999 investigation into online harassment
Cyberstalking
Cyberstalking is the use of the Internet or other electronic means to stalk or harass an individual, a group of individuals, or an organization. It may include false accusations, monitoring, making threats, identity theft, damage to data or equipment, the solicitation of minors for sex, or...
by Keith Schroeder investigators found pornographic images of children on his computer. A second warrant had to be obtained before the evidence could be used to charge Schroeder.
Authentication
As with any evidenceEvidence (law)
The law of evidence encompasses the rules and legal principles that govern the proof of facts in a legal proceeding. These rules determine what evidence can be considered by the trier of fact in reaching its decision and, sometimes, the weight that may be given to that evidence...
, the proponent of digital evidence must lay the proper foundation. Courts largely concerned themselves with the reliability of such digital evidence. As such, early court decisions required that authentication called "for a more comprehensive foundation." US v. Scholle, 553 F.2d 1109 (8th Cir. 1976). As courts became more familiar with digital documents, they backed away from the higher standard and have since held that "computer data compilations… should be treated as any other record." US v. Vela, 673 F.2d 86, 90 (5th Cir. 1982).
A common attack on digital evidence is that digital media can be easily altered. However, in 2002 a US court ruled that "the fact that it is possible to alter data contained in a computer is plainly insufficient to establish untrustworthiness" (US v. Bonallo, 858 F. 2d 1427 - 1988 - Court of Appeals, 9th).
Nevertheless, the "more comprehensive" foundation required by Scholle remains good practice. The American Law Reports
American Law Reports
In American law, the American Law Reports are a resource used by American lawyers to find a variety of sources relating to specific legal rules, doctrines, or principles. It has been published since 1919 and remains an important tool for legal research....
lists a number ways to establish the comprehensive foundation. It suggests that the proponent demonstrate "the reliability of the computer equipment", "the manner in which the basic data was initially entered", "the measures taken to insure the accuracy of the data as entered", "the method of storing the data and the precautions taken to prevent its loss", "the reliability of the computer programs used to process the data", and "the measures taken to verify the accuracy of the program". 7 American Law Reports 4th, 8, 2b.
UK ACPO guidelines
In the United Kingdom examiners usually follow guidelines issued by the Association of Chief Police OfficersAssociation of Chief Police Officers
The Association of Chief Police Officers , established in 1948, is a private limited company that leads the development of policing practice in England, Wales and Northern Ireland.ACPO provides a forum for chief police officers to share ideas and coordinates the strategic...
(ACPO) for the authentication and integrity of evidence. The guidelines consist of four principles:
- No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court.
- In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.
- An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
- The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to.
These guidelines are widely accepted in courts of England and Scotland, but they do not constitute a legal requirement and their use is voluntary.
Best evidence rule
Digital evidence is almost never in a format readable by humans, requiring additional steps to include digital documents as evidence (i.e. printing out the material). It has been argued that this change of format may mean digital evidence does not qualify under the "best evidence ruleBest evidence rule
The best evidence rule is a common law rule of evidence which can be traced back at least as far as the 18th century. In Omychund v Barker 1 Atk, 21, 49; 26 ER 15, 33, Lord Harwicke stated that no evidence was admissible unless it was "the best that the nature of the case will allow"...
". However, the "Federal Rules of Evidence" rule 1001(3) states "if data are stored in a computer…, any printout or other output readable by sight, shown to reflect the data accurately, is an ‘original.’"
Commonly courts do not bar printouts under the best evidence rule. In Aguimatang v. California State Lottery
California State Lottery
The California State Lottery, also known as the California Lottery, began on November 6, 1984, after California voters passed Proposition 37, the California State Lottery Act of 1984, authorizing the creation of a lottery...
, the court gave near per se treatment to the admissibility of digital evidence stating "the computer printout does not violate the best evidence rule, because a computer printout is considered an ‘original.’" 234 Cal. App. 3d 769, 798.
Hearsay
Very often an opponent to digital evidence will object to its admission as hearsayHearsay
Hearsay is information gathered by one person from another person concerning some event, condition, or thing of which the first person had no direct experience. When submitted as evidence, such statements are called hearsay evidence. As a legal term, "hearsay" can also have the narrower meaning of...
. Like documentary evidence
Documentary evidence
Documentary evidence is any evidence introduced at a trial in the form of documents. Although this term is most widely understood to mean writings on paper , the term actually include any media by which information can be preserved...
, not all digital evidence is hearsay.
First, there is some digital evidence which is not hearsay at all. Hearsay is a "statement, other than one made by the declarant while testifying at the trial… offered in evidence to prove the truth of the matter asserted." A declarant is a person. Therefore, courts have held that digital evidence is not hearsay when it is "the by-product of a machine operation which uses for its input ‘statements’ entered into the machine" and was "was generated solely by the electrical and mechanical operations of the computer and telephone equipment." State v. Armstead, 432 So.2d 837, 839 (La. 1983).
Moreover, where the evidence is not offered to prove the truth of the statements, digital evidence is not hearsay. This is the case, for example, with logs of chatroom conversations. While a chatroom log may contain many out of court statements, which would otherwise be hearsay, they may be used for other purposes, including as a party admission
Party admission
-Background:The party admission, in the law of evidence, is a type of statement that appears to be hearsay but is generally exempted from the definition of hearsay.-Party Admissions in U.S...
. US v. Simpson, 152 F.3s 1241 (10th Cir. 1998).
Second, hearsay recognizes a number of exceptions. Most frequently, proponents of digital evidence seek admission under the business records exception
Business records exception
The business records exception to the U.S. hearsay rule is based on Rule 803 of the Federal Rules of Evidence . It is sometimes referred to as the business entry rule.-Scope of exception:...
. This perhaps is because the definition of business records includes a "data compilation." FRE
Federal Rules of Evidence
The is a code of evidence law governing the admission of facts by which parties in the United States federal court system may prove their cases, both civil and criminal. The Rules were enacted in 1975, with subsequent amendments....
803(6). However, obviously not every piece of digital evidence is a business record. Such reliance on the business records exception has had bad results for its proponents. In Monotype Corp. PLC v. International Typeface Corp, the plaintiff
Plaintiff
A plaintiff , also known as a claimant or complainant, is the term used in some jurisdictions for the party who initiates a lawsuit before a court...
s relied on the business records exception to attempt to admit two e-mails as evidence that the defendants had infringed their copyright only to have it excluded by the court. 43 F.3d 443 (9th Cir. 1994). The court noted that the e-mail was not created "in the regular course of [the third party’s] business."
Other proponents have had success with the public records exception, excited utterance
Excited utterance
An excited utterance, in the law of evidence, is a statement made by a person in response to a startling or shocking event or condition. The statement must be spontaneously made by the person while still under the stress of excitement from the event or condition. The subject matter and content...
, Present sense impression
Present sense impression
A present sense impression, in the law of evidence, is a statement made by a person that conveys his or her sense of the state of an event or the condition of something. The statement must be spontaneously made while the person was perceiving A present sense impression, in the law of evidence, is...
, and the FRE 807—the catch-all. Where digital evidence does not meet one of the other exceptions but has "equivalent circumstantial guarantees of trustworthiness" that hearsay seeks to protect against, a court may apply the catch-all.
Further reading
General:- Stephen Mason, general editor, Electronic Evidence (2nd edn, LexisNexis Butterworths, 2010) covering Australia, Canada, England & Wales, Hong Kong, India, Ireland, New Zealand, Scotland, Singapore, South Africa, United States of America
- Stephen Mason, general editor, International Electronic Evidence, (British Institute of International and Comparative Law, 2008), covering Argentina, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Egypt, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Mexico, Netherlands, Norway, Poland, Romania, Russia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Thailand and Turkey
United States of America:
- Michael R Arkfeld, Electronic Discovery and Evidence (Law Partner Publishing, 2003)
- Adam Cohen and David Lender, Electronic Discovery: Law and Practice (Aspen Publishers, 2003)
- Brent E. Kidwell, Matthew M. Neumeier and Brian D. Hansen, Electronic Discovery (Law Journal Press) Looseleaf
- Joan E. Feldman, Essentials of Electronic Discovery: Finding and Using Cyber Evidence (Glasser Legalworks, 2003)
- Gregory P. Joseph, Modern Visual Evidence (Law Journal Press) Looseleaf
- Jay Grenig and William Gleisner, eDiscovery & Digital Evidence (Thomson-West Publishing, 2005)
- Michele C.S. Lange and Kristen M. Nimsger, Electronic Evidence and Discovery: What Every Lawyer Should Know (American Bar Association, 2004)
- Paul R. Rice, Electronic Evidence - Law and Practice (American Bar Association, 2005)
- Sharon Nelson, Bruce A. Olson and John W. Simek, The Electronic Evidence and Discovery Handbook (American Bar Association, 2006)
- Ralph C. Losey, e-Discovery: Current Trends and Cases (American Bar Association, 2008)
- Jonathan D. Frieden and Leigh M. Murray, The Admissibility of Electronic Evidence Under the Federal Rules of Evidence, XVII Rich. J.L. & Tech. 5 (2011).
External links
- Computer and Digital Forensics Discussion Forum
- International Journal of Digital Evidence (IJDE)
- International Organization on Computer Evidence (IOCE)
- Scientific Group on Digital Evidence
- Digital Evidence: Standards and Principles
- The Digital Evidence in the Information Era
- Forensic IT group of ENFSI
- Digital Evidence and Electronic Signature Law Review