Digital Evidence

Nov. 2022 report

NACDL Training and Resource Counsel Clare Garvie has authored a new report titled A Forensic Without the Science: Facial Recognition in U.S. Criminal Investigations. Designed as a resource for defense attorneys, advocates, and the public, it outlines how police face recognition searches are prone to error from under-performing algorithms, the lack of training and cognitive biases of the “human in the loop,” and the interactions between both human and machine. It argues for Brady disclosure of face recognition search information and against the introduction of the technology as evidence in court, showing how face recognition overwhelmingly fails the standards for admissible scientific evidence and testimony. The webpage contains additional resources including a brief, motion, affidavit, and sample discovery motion.

5-page primer from NACDL’s Fourth Amendment Center that prepares attorneys to litigate a motion to suppress a geofence warrant.

This resource contains sample subpoena and evidence preservation language for various types of digital evidence.

Organization of Scientific Area Committees for Forensic Evidence (OSAC) is developing documentary standards for each forensic discipline. Standards under consideration as well as approved standards are available in the OSAC Registry.

The National Institute of Justice’s (NIJ) Forensic Technology Center of Excellence published a Digital Evidence Policies and Procedures Manual to be used as a guide for law enforcement agencies in developing manuals of their own. The manual contains procedures for handling and retaining digital evidence, information about what should be documented in lab reports, and information about quality assurance in digital evidence labs.

This manual is designed to help attorneys prepare themselves and their witnesses for Daubert or related challenges to the admissibility of Cellebrite UFED-extracted mobile device evidence. It contains sample voir dire questions.

Blog post by Larry Daniel, Spencer McInvaille, and Eric Grabski addressing the potential for flaws in cell phone location evidence when mapping software is used and other issues with cell tower evidence.

The Electronic Frontier Foundation received a number of guides regarding information that is maintained by various social networking sites and how to request that information. The guides are posted on their website, under the “documents” tab, scroll down to Social Media Law Enforcement Guides.

The Computer Crime and Intellectual Property Section of the U.S. Department of Justice gathered information about the retention periods for call details, cell tower information, text message content, pictures, and other types of data. This information has been posted online by the ACLU.

This guide contains addresses and phone/fax numbers for the legal departments/subpoena compliance centers of cellular providers and social media sites. Please be aware of 2014 Formal Ethics Opinion 7 when issuing subpoenas. John Rubin’s 2017 blog post on subpoenaing-of-state materials is available here. Email Sarah Rackley Olson if you have any corrections or updated information for the subpoena guide.

Larry Daniel addresses common issues with child pornography cases in this guide. Topics include what information an expert will need and what services an expert may be able to provide. Daniel provides an explanation of technical terms commonly used in these cases.

This guide, prepared by Larry Daniel, provides information on the collection, preservation, and authentication of Facebook evidence from a digital forensics perspective.

NIST has published these guidelines that establishes methods for preserving and processing digital information on mobile devices.

by Aaron Blank, XVIII RICH. J.L. & TECH. 3 (2011). Discusses how a cellular network works, how a cell phone tracks its location, limitations on cell site data as a tracking method, admissibility of cell site data, and constitutional implications for seizure of cell site data. Provides practical suggestions concerning admission and exclusion of this evidence.

See pp. 179-182 for the National Research Counsel’s evaluation of Digital and Multimedia Analysis.

This fourth in a series of guides on digital (computer-related) evidence is addressed to law enforcement officers and prosecutors, as it focuses on key issues in the collection, management, preparation, and courtroom presentation of digital evidence.

National Institute of Justice’s recommendations for how law enforcement and crime scene investigators should handle digital evidence. Evidence on cell phones or computers can be changed or destroyed if proper techniques are not used to forensically analyze the data. This guide may be used to cross examine law enforcement officers who did not follow the recommendations for handling this type of evidence.

Reposted from North Carolina Criminal Law, a UNC School of Government Blog Last September, the Court of Appeals decided State v. Thomas, No. COA23-210, __ N.C. App. __ (2024), a case involving law enforcement’s retrieval of ankle monitor location data gathered while the defendant was on post-release supervision. This is the first North Carolina appellate case …

Digital forensics expert Lars Daniel has a new 8-minute video explaining how he spotted 80 different points where an audio file was edited in a criminal case he testified in a couple of weeks ago.  He did this via a spectrogram analysis, which lets you “see” where audio has been edited, even if you cannot hear it. In …

If you enjoy YouTube as much as my kids do, but are tired of MrBeast and ready for some informative digital forensics content, check out the material that Envista Forensics is creating. Lars Daniel has a 6-minute video on different types of cell phones extractions, with an explanation of why full file system (advanced extractions) …

In some cases involving cell phone extractions, public defenders and other criminal defense attorneys are being provided with incomplete discovery. When the prosecution provides only PDF and UFED Reader reports to defense counsel, this is not complete discovery. While the UFED Reader reports can be helpful in navigating the phone’s data, the UFED Reader is …

Case Background Last September, the NACDL joined forces with the Electronic Frontier Foundation (EFF) and the Electronic Privacy Information Center (EPIC) to file an amicus brief in support of the defense in New Jersey v. Arteaga.  The question before the Appellate Division was whether the defense is entitled to information about how a face recognition search …

The National Institute of Standards and Technology (NIST) finalized a report in Nov. 2022, first published in draft form in May, that reviews the scientific foundations of forensic methods for analyzing computers, mobile phones and other electronic devices. The full report is available here. Attorneys may find the report helpful for several reasons. First, the report …

The Georgetown Law Center on Privacy & Technology has released a new report on face recognition which is designed to serve as a resource for researchers and criminal justice stakeholders encountering this technology. The report, “A Forensic Without the Science: Face Recognition in U.S. Criminal Investigations” and accompanying resources, including a brief, motion, affidavit, and …

Last week an article in The Assembly, The Shooter in the Video, came across my virtual desk. The article focused on the case of James Richardson, who was convicted of murder in Pitt County in 2011, and the work of his family, supporters and his post-conviction attorney Heather Rattelade to overturn his conviction. A key …

We want court appointed attorneys to use experts, and we want using experts to be easier for attorneys. Access to qualified expert services is essential to the provision of indigent defense. To better equip the North Carolina public defense community with the resources it needs to achieve fair and just outcomes for clients, Indigent Defense …

In Feb. 2022, NIST published the results of a study that looked at outcomes of mock mobile and hard-drive examinations by digital forensic examiners. 394 individuals registered for the mobile test, and 77 participants completed the mobile case study. 450 individuals registered for the hard-drive test and 102 participants completed the hard drive case study. …

The purpose of the study was to evaluate the outcomes of mobile and hard-drive forensic results achieved on mock examinations based on the demographic characteristics of the participants. The demographic data related to an individual’s workplace environment, education, and work experience. This study was open to anyone in the public or private sectors who work in the field of digital forensics.

Sunde and Dror 2021 article

Interpol guidelines for best practices for search and seizure of electronic and digital evidence

This study looks at two methods for accessing data on damaged mobile phones.

NACDL’s Fourth Amendment Center has published a primer on whether law enforcement can compel a suspect to unlock or decrypt a device.

Overview of NIJ research on new approaches to acquiring and analyzing digital media.

Yale Law Journal article by Prof. Andrea Roth

Free webinar offered by NACDL

Free webinar offered by NCIDS

Free to attend live multi-day webinar offered by NIST

Free-to-attend recorded webinar offered by NACDL. NACDL membership not required.

Free live webinar offered by NACDL

Free-to-attend webinar offered by NACDL

Free webinar offered by NACDL

90-minute free-to-attend webinar offered by IDS and the Mecklenburg Public Defender's Office

Free to attend webinar offered by NCIDS

Free to attend live webinar presented by IDS

Recorded presentations from May 2022 on various topics of digital forensics

Live webinar presented by Michael Price, Litigation Director for the Fourth Amendment Center at NACDL

Free to attend webinar offered by IDS. Presenter: Lars Daniel

Free training offered by NACDL

Free Webinar offered by NACDL. Presenter: Brendan Max

Free Webinar offered by NACDL. Presenters: Michael Price, Laura Koenig, Spencer McInvaille

Presenter: Dr. Peter Stout

Last October, a report from the technology and justice non-profit Upturn found that over 2,000 law enforcement agencies in all 50 states had purchased mobile device forensic tools (MDFTs) to search, access, and extract sensitive information from cell phones for use in criminal investigations, often without a warrant and with little to no oversight. The widespread availability and use of MDFTs allow law enforcement access to an immensely broad range of data, such as call activity, texts, photos, videos, passwords, geolocation history, and even content that has been deleted or hidden. How can criminal defense attorneys challenge the use of evidence obtained by MDFTs in criminal cases?

On May 11 at 1:00pm ET (4:00pm PT), NACDL’s Fourth Amendment Center will host a FREE, CLE webinar discussing how can criminal defense attorneys recognize and challenge the use of evidence obtained by mobile device forensic tools (MDFTs) in criminal cases. This webinar will feature Jennifer Granick, surveillance and cybersecurity counsel with the ACLU Speech, Privacy, and Technology Project, Jerome Greco, a public defender in the Digital Forensics Unit of the Legal Aid Society in New York City, and Harlan Yu, Executive Director of Upturn.

Live webinar presented by Lars Daniel
April 15, 2021, 1:00 pm
60 min of CLE credit (technology hour) anticipated

Our world is becoming increasingly hyper-connected. The objective of the Internet of things is for everything to communicate and interface with everything. From wearable technology and smart home assistants, to Internet connected medical ingestibles and social credit scores, more data is being collected about us than ever, and this data can and is being used in litigation.

This class will explain how this data is collected from the Internet of things devices, and the places that they store data such as the cloud, cell phones, and computers. Cases involving Internet of things devices such as digital pacemakers, fitness wearables, and smart home assistants will be discussed, with an eye to the future of how this data will become more prevalent and pervasive.

Registration:

This program is part of the 2021 IDS Forensic Science Education Series. The webinars will be presented monthly and are free to attend. Attorneys who want CLE credit for attending will be billed $3.50 per credit hour by the State Bar. Use this link to register for all webinars in the series and attend any that are of interest.

Presenter:

Lars Daniel is the co-author of the book Digital Forensics for Legal Professionals: Understanding Digital Evidence from the Warrant to the Courtroom, published by Syngess, an imprint of Elsevier Publishing. He is also co-author of the book Digital Forensics Trial Graphics: Educating the Jury Through Effective Use of Visuals, Published by Academic Press, 2017. 

Lars is an EnCase Certified Examiner (EnCE), a Cellebrite Certified Operator (CCO), a Cellebrite Certified Physical Analyst (CCPA), a Certified Telecommunications Network Specialist (CTNS), Certified Wireless Analyst (CWA), a Certified Internet Protocol Telecommunications Specialist (CIPTS), and a Certified Telecommunications Analyst (CTA). 

He spoke at the largest annual digital forensics conference, the Computer Enterprise and Investigations Conference (CEIC), in 2011 and 2013, and the EnFuse Conference in 2016 and 2019. He provides dozens of Continuing Legal Education (CLE) and Continuing Education (CE) training classes for attorneys and other professionals across the United States every year. 

Lars has qualified as an expert witness and testified in both state and federal courts, qualifying as a digital forensics expert, computer forensics expert, cell phone forensics expert, video forensics expert, and a photo forensics expert.  He has testified for both the defense and prosecution. Lars has attended over 400 hours of forensic training and has worked on hundreds of cases involving murder, sexual exploitation, terrorism, rape, kidnapping, intellectual property, fraud, wrongful death, employee wrongdoing and insurance losses among numerous other types of cases.

Live webinar, Presenter: Spencer McInvaille

Offered by NACDL. Presented by Mohammad Ali Hamoudi, Jeff Fischbach, and Robert Herz.

Offered by NACDL. Presenters: Debbie Levi and Ivan Bates.

Presenter: Hanni Fakhoury and Rachel Levinson-Waldman. Offered by NACDL on Aug. 6, 2020.

This presentation, now available to view for free, was given as a part of the Center for Statistics and Applications in Forensic Evidence’s (CSAFE) 2020 All Hands Meeting. The meeting brings together researchers, forensic partners, and interested community members to discover potential areas for collaboration, highlight the organization’s achievements, and discuss goals for the future.

The presentation, given by Dr. Padhraic Smyth, a professor of statistics and computer science at the University of California, Irvine, discusses the major accomplishments of various research projects that took place within the world of digital evidence in recent years. Dr. Smyth also describes a number of proposed future digital evidence research projects and opportunities for practitioners to collaborate with researchers from other disciplines.

Materials:

• The video of the presentation is available here
• The slides from the presentation are available here

Envista Forensics will present two free-to-view online CLEs in April. 1.0 hours of General or Information Technology CLE credit is anticipated for each session. Attorneys receiving CLE credit will be billed $3.50 per credit hour by the NC State Bar. The program is being offered for criminal defense attorneys and criminal defense investigators. Registration is available here.

April 17^th 1PM – Basic Cell Phone Forensics
April 24^th 1PM – Basic Cell Phone Location Evidence

Cellebrite is offering a series of free online webinars. If you are looking to understand more about cell phone forensics, these programs should offer you a better understanding of what law enforcement or independent experts are able to find when performing a forensic analysis of a cell phone.

Fundamentals Matter: Part 1 – Basic Setup and Kickstarting the investigation

NACDL is offering a 2-day CLE in Palm Beach, FL that will explore building and using a police database, working with law enforcement experts, what Brady means in modern 2020, and the intersection between technology and misconduct including the ways law enforcement employs body cameras and facial recognition technology. The program includes specific skills-based lectures that will teach effective trial and motions techniques.  

The importance of taking on prosecution forensic experts on behalf of clients cannot be overstated. It is no mystery how powerful forensic evidence is to jurors.  Yet countless wrongful convictions are, in fact, the result of inaccurate, faulty, or unchallenged forensics. This practical workshop will prepare defense counsel to challenge unreliable expert testimony using a mock case involving firearm and digital evidence.

Tuition is $795.00.  Program dates are January 16-18, 2020 at the University of Arizona James E. Rogers College of Law at Address:  1201 E. Speedway, Tucson, AZ 85721.  Accommodations (not included in tuition) are offered at the Aloft Tucson University, just 1 mile from the law school. Special hotel block rate is $179.00 (plus tax)/night. Hotel block expires 12/24.

The National Criminal Defense College will offer a program in Tucson, Arizona on challenging faulty forensic testimony.

Tuition is $795.00.  Program dates are January 16-18, 2020 at the University of Arizona James E. Rogers College of Law at Address:  1201 E. Speedway, Tucson, AZ 85721.  Accommodations (not included in tuition) are offered at the Aloft Tucson University, just 1 mile from the law school with a special hotel block rate of $179.00 (plus tax)/night.  (Hotel block expires 12/24.)

From encrypting your documents, texts and emails to using a private Internet browser, this webinar will walk through a curated list of tools and tricks designed to protect your work product, your technology, your clients, and your cases. The webinar will feature Matt Mitchell, a hacker, civil rights advocate, and the director of digital safety & privacy at Tactical Tech.

This free webinar is sponsored by NACDL and is open to criminal defense attorneys, regardless of whether they are NACDL members.

The National Association for Public Defense is sponsoring this one (1) hour training on the importance of cell tower evidence and how to utilize the data to better defend their clients.

About the Faculty:  Tom Slovenski is the owner of Cellular Forensics, LLC, located in South Carolina. As a former law enforcement detective and now a private forensics examiner, Tom has over 30 years of Law Enforcement and Investigation experience. Tom was a Sergeant with a large metropolitan Sheriff’s Department and member of the Forensics Division while serving as the Senior Investigator of Internal Affairs.

In the private sector, Tom specializes in mobile phone data recovery and acquisitions, cell tower site analysis and mobile spyware discovery. Tom also endeavors to train attorneys, and other investigative professionals on the importance and value of Cell Phone Data Recovery and Cell Tower Records Analysis. Tom’s classes have been attended by Federal, State and local entities nationwide.

Tom is the author of a book on Mobile Phone Forensics entitled, “Cellular Forensics for First Responders.”

The Mecklenburg County Public Defender’s Office is hosting a free to attend CLE on Cell Location Evidence for Legal Professionals.

This CLE is for the criminal defense attorney who faces cell phone location evidence in their cases. The speaker will discuss how cell phones and cell phone networks operate, cell phone call detail records, precision location, and real-time location data. Case examples will be reviewed to see how this information has worked in prior cases. Finally, legal issues with cell location evidence and applicable case law will be covered.

The speaker will be Spencer McInvaille, a Digital Forensic Examiner, specializing in cellular location analysis at Envista Forensics. He holds certifications in telecommunications and cell phone forensics, such as Cellebrite Certified Operator, Certified Wireless Analyst and Certified Telecommunications Network Specialist. Spencer has qualified and testified as an expert witness in the area of cellular location analysis. Prior to his career at Envista Forensics, Spencer worked in law enforcement as a Violent Crimes Investigator in South Carolina where he investigated crimes such as murder, robbery, and aggravated assault. During his time as a law enforcement officer, Spencer also performed cellular location analysis and mobile forensics. He has over 190 hours of training in cellular location analysis and mobile phone forensics. He has also worked on state and federal cases across the United States.

The CLE will be held July 12, 2019 at the Mecklenburg County Public Defender’s Office in the 4th Floor Conference Room at 702 E 4th St., Charlotte, NC. Registration begins at 12:00 and the CLE starts at 12:30. Pending approval by the NC State Bar, this CLE is for one general hour and the NC State Bar will charge you $3.50.

Register here.

Contact Anthony.Monaghan@mecklenburgcountync.gov for additional information.

This one-day NACDL symposium was recorded on April 3, 2015 and is available for free viewing. Topics include how digital searches, government surveillance programs and new technologies are impacting Fourth Amendment protections in criminal cases.

60 minute on-demand School of Government virtual CLE by digital forensics expert Larry Daniel that provides an overview of digital forensic concepts, case examples, and relevant terminology. Attorneys will learn the basic information needed to understand the process of computer and cell phone forensics and the proper methods for search and seizure of electronic evidence. The presentation can be viewed for free or for CLE credit.

A searchable database, created by the Electronic Frontier Foundation in partnership with the Reynolds School of Journalism at the University of Nevada, Reno, on the surveillance technologies in use in jurisdictions across the country. The site also contains a glossary with a brief descriptions of each surveillance method listed in the database.

Blog posts on various topics of digital evidence published at the UNC School of Government.

A USA TODAY Network investigation uncovered records of thousands of police officers investigated for serious misconduct. Starting with lists of officers who lost their law enforcement certification in 44 states, including North Carolina, those records available here.

A collaboration between the Orlando Public Defender and the National Center for Forensic Science at UC Florida. The site has links to many helpful training videos that help attorneys understand forensic science evidence.

Free or low-cost software tools that may be of assistance in understanding forensic evidence disciplines of digital forensics, arson investigation, DNA, death investigation, and more.

The National Forensic Science Technology Center created this website to explain in simplified terms the principles of each type of forensic analysis and how the analysis is performed. Topics include DNA, digital evidence, fingerprints, firearms, trace evidence, blood stains, and more.

Forensic Magazine regularly posts articles on digital forensics. Recent topics include: SIM card forensics, cell phone evidence, and collecting computer evidence.

Offers direct assistance to defense lawyers handling cases involving new technologies and tactics that may infringe on privacy rights of Americans.

Nonprofit that defends digital privacy. Website includes information on cell tracking, locational privacy, pen trap, surveillance technologies, and more.

• Cell Tracking – Considers whether the government can use cell phone records to track the physical location of a suspect without first obtaining a warrant based on probable cause.
• Printers – Discusses the practice of color laser printer manufacturers encoding of identifying information on each page printed by the machine. Explores the privacy implications of this practice.
• Revised Opinion in Privacy Case Blurs Clear Limits to Digital Search and Seizure – Discusses a 2010 Ninth Circuit case dealing with proper procedure for electronic searches.

Provides the name of the service provider associated with a phone number.

The Computer Crime and Intellectual Property Section of the U.S. Department of Justice gathered information about the retention periods for call details, cell tower information, text message content, pictures, and other types of data. This information has been posted online by the ACLU.

Search this directory of wireless and internet service providers to find contact information for legal departments. This directory was created for law enforcement use through a grant from the DOJ.

The Digital Evidence Subcommittee of OSAC focuses on standards and guidelines related to information of probative value that is stored or transmitted in binary form. 

Composed of member organizations that are actively engaged in the field of digital and multimedia evidence. Works to foster communication and cooperation and ensure quality and consistency within the forensic community.

A guide to the legal issues presented by the collection of digital evidence in criminal cases, written mainly for North Carolina judges, lawyers, and officers. This book addresses how such evidence may be obtained and the rules that govern its use in court and is available for purchase.

by Linda Volonino and Reynaldo Anzaldua – this book provides an excellent introduction to the topic. An overview of the materials is available in an online “cheat sheet.”

COA held that the defendant is entitled to face recognition information as part of requested discovery in accordance with Brady v. Maryland.

EDVA decision holding a geofence warrant was unconstitutional.

Detective testified about cell phone tower location and determined direction of tower based on records. COA held Detective’s testimony was limited to illustrating and interpreting the admitted cell phone records, therefore it did not require scientific or other specialized knowledge and was not expert testimony.

Defendant’s CSLI was searched pursuant to a court order, instead of a warrant. However, the court held that the order met the warrant requirements. Thus, there was no error and the defendant was not entitled to suppression of CSLI on Fourth Amendment grounds. 

Rule 701 allows a non-expert to testify in the form of opinion or inference where it is rationally based on a perception of the witness and helpful to the determination of a fact in issue. Testimony from a lay witness and an officer about their suspicion that the defendant used an app to conceal text messages and regarding record keeping of those messages was an error, but not plain error.

Sample order for cell phone records pursuant to a discovery motion.