Digital Evidence

This resource contains sample subpoena and evidence preservation language for various types of digital evidence.

The Organization of Scientific Area Committees for Forensic Evidence (OSAC) develops documentary standards for forensics through a standards developing organization or other consensus-based process that allows for participation and comment from relevant stakeholders. Standards under consideration as well as approved standards are available in the OSAC Registry. Standards are being developed for each forensic discipline.

The National Institute of Justice’s (NIJ) Forensic Technology Center of Excellence published a Digital Evidence Policies and Procedures Manual to be used as a guide for law enforcement agencies in developing manuals of their own. The manual contains procedures for handling and retaining digital evidence, information about what should be documented in lab reports, and information about quality assurance in digital evidence labs.

This manual is designed to help attorneys prepare themselves and their witnesses for Daubert or related challenges to the admissibility of Cellebrite UFED-extracted mobile device evidence. It contains sample voir dire questions.

Blog post by Larry Daniel, Spencer McInvaille, and Eric Grabski addressing the potential for flaws in cell phone location evidence when mapping software is used and other issues with cell tower evidence.

The Electronic Frontier Foundation received a number of guides regarding information that is maintained by various social networking sites and how to request that information. The guides are posted on their website, under the “documents” tab, scroll down to Social Media Law Enforcement Guides.

The Computer Crime and Intellectual Property Section of the U.S. Department of Justice gathered information about the retention periods for call details, cell tower information, text message content, pictures, and other types of data. This information has been posted online by the ACLU.

This guide contains addresses and phone/fax numbers for the legal departments/subpoena compliance centers of cellular providers and social media sites. Please be aware of 2014 Formal Ethics Opinion 7 when issuing subpoenas. John Rubin’s 2017 blog post on subpoenaing-of-state materials is available here. Email Sarah Rackley Olson if you have any corrections or updated information for the subpoena guide.

Larry Daniel addresses common issues with child pornography cases in this guide. Topics include what information an expert will need and what services an expert may be able to provide. Daniel provides an explanation of technical terms commonly used in these cases.

This guide, prepared by Larry Daniel, provides information on the collection, preservation, and authentication of Facebook evidence from a digital forensics perspective.

NIST has published these guidelines that establishes methods for preserving and processing digital information on mobile devices.

by Aaron Blank, XVIII RICH. J.L. & TECH. 3 (2011). Discusses how a cellular network works, how a cell phone tracks its location, limitations on cell site data as a tracking method, admissibility of cell site data, and constitutional implications for seizure of cell site data. Provides practical suggestions concerning admission and exclusion of this evidence.

See pp. 179-182 for the National Research Counsel’s evaluation of Digital and Multimedia Analysis.

This fourth in a series of guides on digital (computer-related) evidence is addressed to law enforcement officers and prosecutors, as it focuses on key issues in the collection, management, preparation, and courtroom presentation of digital evidence.

National Institute of Justice’s recommendations for how law enforcement and crime scene investigators should handle digital evidence. Evidence on cell phones or computers can be changed or destroyed if proper techniques are not used to forensically analyze the data. This guide may be used to cross examine law enforcement officers who did not follow the recommendations for handling this type of evidence.

Live webinar presented by Lars DanielApril 15, 2021, 1:00 pm60 min of CLE credit (technology hour) anticipated Our world is becoming increasingly hyper-connected. The objective of the Internet of things is for everything to communicate and interface with everything. From wearable technology and smart home assistants, to Internet connected medical ingestibles and social credit scores, more data …

In Dec. 2020, the NC State Crime Laboratory posted a new Forensic Update for criminal justice stakeholders regarding digital evidence. The update addresses how digital evidence should be submitted to the lab and the lab’s examination capabilities. Attorneys should review the Forensic Update to have a better understanding of how the lab will process digital …

Just Science is a forensic science podcast funded by the NIJ’s Forensic Technology Center of Excellence. The current season of Just Science is devoted to digital evidence, including the history and interpretation of digital evidence, emerging technologies used in investigation and as evidence, and the validation of digital forensic tools.  Attorneys may be particularly interested …

On Monday, July 13th, the Electronic Frontier Foundation put out a press release (available here) announcing the launch of their Atlas of Surveillance. The Atlas, created in partnership with the Reynolds School of Journalism at the University of Nevada, Reno, is a searchable database of the specific surveillance technology law enforcement agencies across the country …

This past Sunday, on his weekly half-hour HBO show, Last Week Tonight, comedian John Oliver discussed the growing prevalence of facial recognition technology in the criminal justice system. The issue is particularly relevant as protestors in the recent demonstrations demanding justice for George Floyd (and the numerous other BIPOC who have been subjected to violence …

This month the National Institute of Justice’s (NIJ) Forensic Technology Center of Excellence published a Digital Evidence Policies and Procedures Manual to be used as a guide for law enforcement agencies. The preface to the manual clarifies that policies and procedures should be tailored to fit each lab’s particular circumstances, and further that a manual …

Originally posted on the Envista Forensics Blog on Oct. 7, 2019 by Larry Daniel, Spencer McInvaille, Eric Grabski The amount of cell phone record location information being admitted as evidence in trial is occurring at an unprecedented rate. Juries across the U.S., and globally are being presented with call detail record analysis as evidence of …

The NACDL Fourth Amendment Center has authored a Compelled Decryption Primer to help attorneys litigate the issue of whether law enforcement can compel a suspect to unlock or decrypt a device. The Fourth Amendment requires law enforcement to get a warrant to search a cell phone, even incident to arrest. Riley v. California, 573 U.S. …

NACDL’s Fourth Amendment Center now offers direct assistance to defense lawyers handling cases involving new technologies and tactics that may infringe on privacy rights of Americans. The Center’s staff is available to help members of the defense bar in bringing new Fourth Amendment challenges, providing a range of support from training and resources to expert …

With a focus on Fourth Amendment concerns, the National Association of Criminal Defense Lawyers (NACDL) recently began a series of surveillance primers. The first primers in the series provide information on Automated License Plate Readers, Cell Phone Location Tracking, and Cell Site Simulators. NACDL will periodically release more primers on surveillance technologies. These documents are …

This study looks at two methods for accessing data on damaged mobile phones.

NACDL’s Fourth Amendment Center has published a primer on whether law enforcement can compel a suspect to unlock or decrypt a device.

Overview of NIJ research on new approaches to acquiring and analyzing digital media.

Live webinar presented by Lars Daniel
April 15, 2021, 1:00 pm
60 min of CLE credit (technology hour) anticipated

Our world is becoming increasingly hyper-connected. The objective of the Internet of things is for everything to communicate and interface with everything. From wearable technology and smart home assistants, to Internet connected medical ingestibles and social credit scores, more data is being collected about us than ever, and this data can and is being used in litigation.

This class will explain how this data is collected from the Internet of things devices, and the places that they store data such as the cloud, cell phones, and computers. Cases involving Internet of things devices such as digital pacemakers, fitness wearables, and smart home assistants will be discussed, with an eye to the future of how this data will become more prevalent and pervasive.

Registration:

This program is part of the 2021 IDS Forensic Science Education Series. The webinars will be presented monthly and are free to attend. Attorneys who want CLE credit for attending will be billed $3.50 per credit hour by the State Bar. Use this link to register for all webinars in the series and attend any that are of interest.

Presenter:

Lars Daniel is the co-author of the book Digital Forensics for Legal Professionals: Understanding Digital Evidence from the Warrant to the Courtroom, published by Syngess, an imprint of Elsevier Publishing. He is also co-author of the book Digital Forensics Trial Graphics: Educating the Jury Through Effective Use of Visuals, Published by Academic Press, 2017. 

Lars is an EnCase Certified Examiner (EnCE), a Cellebrite Certified Operator (CCO), a Cellebrite Certified Physical Analyst (CCPA), a Certified Telecommunications Network Specialist (CTNS), Certified Wireless Analyst (CWA), a Certified Internet Protocol Telecommunications Specialist (CIPTS), and a Certified Telecommunications Analyst (CTA). 

He spoke at the largest annual digital forensics conference, the Computer Enterprise and Investigations Conference (CEIC), in 2011 and 2013, and the EnFuse Conference in 2016 and 2019. He provides dozens of Continuing Legal Education (CLE) and Continuing Education (CE) training classes for attorneys and other professionals across the United States every year. 

Lars has qualified as an expert witness and testified in both state and federal courts, qualifying as a digital forensics expert, computer forensics expert, cell phone forensics expert, video forensics expert, and a photo forensics expert.  He has testified for both the defense and prosecution. Lars has attended over 400 hours of forensic training and has worked on hundreds of cases involving murder, sexual exploitation, terrorism, rape, kidnapping, intellectual property, fraud, wrongful death, employee wrongdoing and insurance losses among numerous other types of cases.

Live webinar, Presenter: Spencer McInvaille

Offered by NIST

Offered by NACDL. Presented by Mohammad Ali Hamoudi, Jeff Fischbach, and Robert Herz.

Offered by NACDL. Presenters: Debbie Levi and Ivan Bates.

Presenter: Hanni Fakhoury and Rachel Levinson-Waldman. Offered by NACDL on Aug. 6, 2020.

This presentation, now available to view for free, was given as a part of the Center for Statistics and Applications in Forensic Evidence’s (CSAFE) 2020 All Hands Meeting. The meeting brings together researchers, forensic partners, and interested community members to discover potential areas for collaboration, highlight the organization’s achievements, and discuss goals for the future.

The presentation, given by Dr. Padhraic Smyth, a professor of statistics and computer science at the University of California, Irvine, discusses the major accomplishments of various research projects that took place within the world of digital evidence in recent years. Dr. Smyth also describes a number of proposed future digital evidence research projects and opportunities for practitioners to collaborate with researchers from other disciplines.

Materials:

• The video of the presentation is available here
• The slides from the presentation are available here

Envista Forensics will present two free-to-view online CLEs in April. 1.0 hours of General or Information Technology CLE credit is anticipated for each session. Attorneys receiving CLE credit will be billed $3.50 per credit hour by the NC State Bar. The program is being offered for criminal defense attorneys and criminal defense investigators. Registration is available here.

April 17^th 1PM – Basic Cell Phone Forensics
April 24^th 1PM – Basic Cell Phone Location Evidence

Cellebrite is offering a series of free online webinars. If you are looking to understand more about cell phone forensics, these programs should offer you a better understanding of what law enforcement or independent experts are able to find when performing a forensic analysis of a cell phone.

Fundamentals Matter: Part 1 – Basic Setup and Kickstarting the investigation

NACDL is offering a 2-day CLE in Palm Beach, FL that will explore building and using a police database, working with law enforcement experts, what Brady means in modern 2020, and the intersection between technology and misconduct including the ways law enforcement employs body cameras and facial recognition technology. The program includes specific skills-based lectures that will teach effective trial and motions techniques.  

The importance of taking on prosecution forensic experts on behalf of clients cannot be overstated. It is no mystery how powerful forensic evidence is to jurors.  Yet countless wrongful convictions are, in fact, the result of inaccurate, faulty, or unchallenged forensics. This practical workshop will prepare defense counsel to challenge unreliable expert testimony using a mock case involving firearm and digital evidence.

Tuition is $795.00.  Program dates are January 16-18, 2020 at the University of Arizona James E. Rogers College of Law at Address:  1201 E. Speedway, Tucson, AZ 85721.  Accommodations (not included in tuition) are offered at the Aloft Tucson University, just 1 mile from the law school. Special hotel block rate is $179.00 (plus tax)/night. Hotel block expires 12/24.

The National Criminal Defense College will offer a program in Tucson, Arizona on challenging faulty forensic testimony.

Tuition is $795.00.  Program dates are January 16-18, 2020 at the University of Arizona James E. Rogers College of Law at Address:  1201 E. Speedway, Tucson, AZ 85721.  Accommodations (not included in tuition) are offered at the Aloft Tucson University, just 1 mile from the law school with a special hotel block rate of $179.00 (plus tax)/night.  (Hotel block expires 12/24.)

From encrypting your documents, texts and emails to using a private Internet browser, this webinar will walk through a curated list of tools and tricks designed to protect your work product, your technology, your clients, and your cases. The webinar will feature Matt Mitchell, a hacker, civil rights advocate, and the director of digital safety & privacy at Tactical Tech.

This free webinar is sponsored by NACDL and is open to criminal defense attorneys, regardless of whether they are NACDL members.

Co-sponsored by the NC State Crime Laboratory & Office of Indigent Defense Services

The NC State Crime Laboratory and NC Office of Indigent Defense Services will offer a free-to-attend CLE that is designed to enhance the knowledge of criminal defense attorneys and criminal defense investigators. Senior forensic scientists from the State Crime Lab will present updates and key information about the analysis of physical evidence in the disciplines of Forensic Biology (DNA), Firearms, and Digital Evidence. The Laboratory is working on validating the use of a new software program (STRMix) to interpret DNA mixtures. Once this software is implemented, DNA laboratory reports will have a new format and new conclusions will be used. This program aims to familiarize attorneys with this new program and the testimony that will be provided in court.

Following these presentations, the speakers will address questions from attorneys. Due to the confidential nature of casework, questions about specific cases will not be answered. Attorneys can schedule a meeting at the State Crime Lab to discuss the case with the analyst. Registration is available here. Attendees are encouraged to submit questions ahead of time using the registration form or by emailing sarah.r.olson@nccourts.org.

Attorneys receiving CLE credit will be billed $3.50 per credit hour by the NC State Bar. 3.0 hours of general CLE credit is anticipated. Non-attorneys who wish to receive continuing education credit will receive certificates of attendance.

The National Association for Public Defense is sponsoring this one (1) hour training on the importance of cell tower evidence and how to utilize the data to better defend their clients.

About the Faculty:  Tom Slovenski is the owner of Cellular Forensics, LLC, located in South Carolina. As a former law enforcement detective and now a private forensics examiner, Tom has over 30 years of Law Enforcement and Investigation experience. Tom was a Sergeant with a large metropolitan Sheriff’s Department and member of the Forensics Division while serving as the Senior Investigator of Internal Affairs.

In the private sector, Tom specializes in mobile phone data recovery and acquisitions, cell tower site analysis and mobile spyware discovery. Tom also endeavors to train attorneys, and other investigative professionals on the importance and value of Cell Phone Data Recovery and Cell Tower Records Analysis. Tom’s classes have been attended by Federal, State and local entities nationwide.

Tom is the author of a book on Mobile Phone Forensics entitled, “Cellular Forensics for First Responders.”

The Mecklenburg County Public Defender’s Office is hosting a free to attend CLE on Cell Location Evidence for Legal Professionals.

This CLE is for the criminal defense attorney who faces cell phone location evidence in their cases. The speaker will discuss how cell phones and cell phone networks operate, cell phone call detail records, precision location, and real-time location data. Case examples will be reviewed to see how this information has worked in prior cases. Finally, legal issues with cell location evidence and applicable case law will be covered.

The speaker will be Spencer McInvaille, a Digital Forensic Examiner, specializing in cellular location analysis at Envista Forensics. He holds certifications in telecommunications and cell phone forensics, such as Cellebrite Certified Operator, Certified Wireless Analyst and Certified Telecommunications Network Specialist. Spencer has qualified and testified as an expert witness in the area of cellular location analysis. Prior to his career at Envista Forensics, Spencer worked in law enforcement as a Violent Crimes Investigator in South Carolina where he investigated crimes such as murder, robbery, and aggravated assault. During his time as a law enforcement officer, Spencer also performed cellular location analysis and mobile forensics. He has over 190 hours of training in cellular location analysis and mobile phone forensics. He has also worked on state and federal cases across the United States.

The CLE will be held July 12, 2019 at the Mecklenburg County Public Defender’s Office in the 4th Floor Conference Room at 702 E 4th St., Charlotte, NC. Registration begins at 12:00 and the CLE starts at 12:30. Pending approval by the NC State Bar, this CLE is for one general hour and the NC State Bar will charge you $3.50.

Register here.

Contact Anthony.Monaghan@mecklenburgcountync.gov for additional information.

This one-day NACDL symposium was recorded on April 3, 2015 and is available for free viewing. Topics include how digital searches, government surveillance programs and new technologies are impacting Fourth Amendment protections in criminal cases.

60 minute on-demand School of Government virtual CLE by digital forensics expert Larry Daniel that provides an overview of digital forensic concepts, case examples, and relevant terminology. Attorneys will learn the basic information needed to understand the process of computer and cell phone forensics and the proper methods for search and seizure of electronic evidence. The presentation can be viewed for free or for CLE credit.

A searchable database, created by the Electronic Frontier Foundation in partnership with the Reynolds School of Journalism at the University of Nevada, Reno, on the surveillance technologies in use in jurisdictions across the country. The site also contains a glossary with a brief descriptions of each surveillance method listed in the database.

Blog posts on various topics of digital evidence published at the UNC School of Government.

A USA TODAY Network investigation uncovered records of thousands of police officers investigated for serious misconduct. Starting with lists of officers who lost their law enforcement certification in 44 states, including North Carolina, those records available here.

A collaboration between the Orlando Public Defender and the National Center for Forensic Science at UC Florida. The site has links to many helpful training videos that help attorneys understand forensic science evidence.

The NIJ has a number of free or low cost software tools that may be of assistance in understanding forensic evidence disciplines of digital forensics, arson investigation, DNA, death investigation, and more.

The National Forensic Science Technology Center created this website to explain in simplified terms the principles of each type of forensic analysis and how the analysis is performed. Topics include DNA, digital evidence, fingerprints, firearms, trace evidence, blood stains, and more.

Forensic Magazine regularly posts articles on digital forensics. Recent topics include: SIM card forensics, cell phone evidence, and collecting computer evidence.

Offers direct assistance to defense lawyers handling cases involving new technologies and tactics that may infringe on privacy rights of Americans.

Nonprofit that defends digital privacy. Website includes information on cell tracking, locational privacy, pen trap, surveillance technologies, and more.

• Cell Tracking – Considers whether the government can use cell phone records to track the physical location of a suspect without first obtaining a warrant based on probable cause.
• Printers – Discusses the practice of color laser printer manufacturers encoding of identifying information on each page printed by the machine. Explores the privacy implications of this practice.
• Revised Opinion in Privacy Case Blurs Clear Limits to Digital Search and Seizure – Discusses a 2010 Ninth Circuit case dealing with proper procedure for electronic searches.

Provides the name of the service provider associated with a phone number.

The Computer Crime and Intellectual Property Section of the U.S. Department of Justice gathered information about the retention periods for call details, cell tower information, text message content, pictures, and other types of data. This information has been posted online by the ACLU.

Search this directory of wireless and internet service providers to find contact information for legal departments. This directory was created for law enforcement use through a grant from the DOJ.

The Digital Evidence Subcommittee of OSAC focuses on standards and guidelines related to information of probative value that is stored or transmitted in binary form. 

Composed of member organizations that are actively engaged in the field of digital and multimedia evidence. Works to foster communication and cooperation and ensure quality and consistency within the forensic community.

A guide to the legal issues presented by the collection of digital evidence in criminal cases, written mainly for North Carolina judges, lawyers, and officers. This book addresses how such evidence may be obtained and the rules that govern its use in court and is available for purchase.

by Linda Volonino and Reynaldo Anzaldua – this book provides an excellent introduction to the topic. An overview of the materials is available in an online “cheat sheet.”

Defendant’s CSLI was searched pursuant to a court order, instead of a warrant. However, the court held that the order met the warrant requirements. Thus, there was no error and the defendant was not entitled to suppression of CSLI on Fourth Amendment grounds. 

Rule 701 allows a non-expert to testify in the form of opinion or inference where it is rationally based on a perception of the witness and helpful to the determination of a fact in issue. Testimony from a lay witness and an officer about their suspicion that the defendant used an app to conceal text messages and regarding record keeping of those messages was an error, but not plain error.

Sample order for cell phone records pursuant to a discovery motion.