Digital Evidence

Section 724.1 et seq contains guidance on admissibility of various forms of digital evidence.

Nov. 2022 report

NACDL Training and Resource Counsel Clare Garvie has authored a new report titled A Forensic Without the Science: Facial Recognition in U.S. Criminal Investigations. Designed as a resource for defense attorneys, advocates, and the public, it outlines how police face recognition searches are prone to error from under-performing algorithms, the lack of training and cognitive biases of the “human in the loop,” and the interactions between both human and machine. It argues for Brady disclosure of face recognition search information and against the introduction of the technology as evidence in court, showing how face recognition overwhelmingly fails the standards for admissible scientific evidence and testimony. The webpage contains additional resources including a brief, motion, affidavit, and sample discovery motion.

5-page primer from NACDL’s Fourth Amendment Center that prepares attorneys to litigate a motion to suppress a geofence warrant.

This resource contains sample subpoena and evidence preservation language for various types of digital evidence.

Organization of Scientific Area Committees for Forensic Evidence (OSAC) is developing documentary standards for each forensic discipline. Standards under consideration as well as approved standards are available in the OSAC Registry.

The National Institute of Justice’s (NIJ) Forensic Technology Center of Excellence published a Digital Evidence Policies and Procedures Manual to be used as a guide for law enforcement agencies in developing manuals of their own. The manual contains procedures for handling and retaining digital evidence, information about what should be documented in lab reports, and information about quality assurance in digital evidence labs.

This manual is designed to help attorneys prepare themselves and their witnesses for Daubert or related challenges to the admissibility of Cellebrite UFED-extracted mobile device evidence. It contains sample voir dire questions.

Blog post by Larry Daniel, Spencer McInvaille, and Eric Grabski addressing the potential for flaws in cell phone location evidence when mapping software is used and other issues with cell tower evidence.

Retention periods for call details, cell tower information, text message content, pictures, and other types of data from a CAST presentation shared in a 2021 Vice article.

This 2015 guide contains addresses and phone/fax numbers for the legal departments/subpoena compliance centers of cellular providers and social media sites. Please be aware of 2014 Formal Ethics Opinion 7 when issuing subpoenas. John Rubin’s 2017 blog post on subpoenaing-of-state materials is available here. Email Sarah Rackley Olson if you have any corrections or updated information for the subpoena guide. This website contains more up-to-date contact information for legal departments/subpoena compliance centers.

Larry Daniel addresses common issues with child pornography cases in this guide. Topics include what information an expert will need and what services an expert may be able to provide. Daniel provides an explanation of technical terms commonly used in these cases.

This guide, prepared by Larry Daniel, provides information on the collection, preservation, and authentication of Facebook evidence from a digital forensics perspective.

NIST has published these guidelines that establishes methods for preserving and processing digital information on mobile devices.

See pp. 179-182 for the National Research Counsel’s evaluation of Digital and Multimedia Analysis.

From NACDL’s Fourth Amendment Center – One of the most challenging parts of litigating surveillance technology in criminal cases is identifying and getting access to appropriate discovery. Often, the types of technologies used in a case are opaque and cannot be identified, let alone challenged, until certain information is shared during discovery. Even if you …

The Discovery Demand for AI and Surveillance Technology Evidence template created by Mitha Nandagopalan of the Innocence Project’s Strategic Litigation Department outlines categories of discovery that can be requested in cases involving artificial intelligence and surveillance tools. By reviewing this list and incorporating relevant requests in their discovery motions, attorneys can seek disclosure of technological …

Reposted from North Carolina Criminal Law, a UNC School of Government Blog Last September, the Court of Appeals decided State v. Thomas, No. COA23-210, __ N.C. App. __ (2024), a case involving law enforcement’s retrieval of ankle monitor location data gathered while the defendant was on post-release supervision. This is the first North Carolina appellate case …

Digital forensics expert Lars Daniel has a new 8-minute video explaining how he spotted 80 different points where an audio file was edited in a criminal case he testified in a couple of weeks ago.  He did this via a spectrogram analysis, which lets you “see” where audio has been edited, even if you cannot hear it. In …

If you enjoy YouTube as much as my kids do, but are tired of MrBeast and ready for some informative digital forensics content, check out the material that Envista Forensics is creating. Lars Daniel has a 6-minute video on different types of cell phones extractions, with an explanation of why full file system (advanced extractions) …

In some cases involving cell phone extractions, public defenders and other criminal defense attorneys are being provided with incomplete discovery. When the prosecution provides only PDF and UFED Reader reports to defense counsel, this is not complete discovery. While the UFED Reader reports can be helpful in navigating the phone’s data, the UFED Reader is …

Case Background Last September, the NACDL joined forces with the Electronic Frontier Foundation (EFF) and the Electronic Privacy Information Center (EPIC) to file an amicus brief in support of the defense in New Jersey v. Arteaga.  The question before the Appellate Division was whether the defense is entitled to information about how a face recognition search …

The National Institute of Standards and Technology (NIST) finalized a report in Nov. 2022, first published in draft form in May, that reviews the scientific foundations of forensic methods for analyzing computers, mobile phones and other electronic devices. The full report is available here. Attorneys may find the report helpful for several reasons. First, the report …

The Georgetown Law Center on Privacy & Technology has released a new report on face recognition which is designed to serve as a resource for researchers and criminal justice stakeholders encountering this technology. The report, “A Forensic Without the Science: Face Recognition in U.S. Criminal Investigations” and accompanying resources, including a brief, motion, affidavit, and …

Last week an article in The Assembly, The Shooter in the Video, came across my virtual desk. The article focused on the case of James Richardson, who was convicted of murder in Pitt County in 2011, and the work of his family, supporters and his post-conviction attorney Heather Rattelade to overturn his conviction. A key …

Sunde and Dror 2021 article

Interpol guidelines for best practices for search and seizure of electronic and digital evidence

This study looks at two methods for accessing data on damaged mobile phones.

NACDL’s Fourth Amendment Center has published a primer on whether law enforcement can compel a suspect to unlock or decrypt a device.

Overview of NIJ research on new approaches to acquiring and analyzing digital media.

Yale Law Journal article by Prof. Andrea Roth

Free recorded webinar program presented by NACDL

Free webinar offered by NACDL

Free to attend live multi-day webinar offered by NIST

Free-to-attend recorded webinar offered by NACDL. NACDL membership not required.

Free-to-attend webinar offered by NACDL

Free webinar offered by NACDL

Recorded presentations from May 2022 on various topics of digital forensics

Free Webinar offered by NACDL. Presenter: Brendan Max

Free Webinar offered by NACDL. Presenters: Michael Price, Laura Koenig, Spencer McInvaille

Offered by NACDL. Presented by Mohammad Ali Hamoudi, Jeff Fischbach, and Robert Herz.

Offered by NACDL. Presenters: Debbie Levi and Ivan Bates.

Presenter: Hanni Fakhoury and Rachel Levinson-Waldman. Offered by NACDL on Aug. 6, 2020.

Cellebrite is offering a series of free online webinars. If you are looking to understand more about cell phone forensics, these programs should offer you a better understanding of what law enforcement or independent experts are able to find when performing a forensic analysis of a cell phone.

Fundamentals Matter: Part 1 – Basic Setup and Kickstarting the investigation

Provides subpoena templates, discovery resources, and guides to assist attorneys in cases involving digital evidence including:

• Cell Phone Forensic Reports & Exports Guide – a 19 page PDF explaining cell phone extraction reports and their limitations
• UFED Reader Guide – Is All the Data There?

A searchable database, created by the Electronic Frontier Foundation in partnership with the Reynolds School of Journalism at the University of Nevada, Reno, on the surveillance technologies in use in jurisdictions across the country. The site also contains a glossary with a brief descriptions of each surveillance method listed in the database.

Blog posts on various topics of digital evidence published at the UNC School of Government.

A USA TODAY Network investigation uncovered records of thousands of police officers investigated for serious misconduct. Starting with lists of officers who lost their law enforcement certification in 44 states, including North Carolina, those records available here.

Free or low-cost software tools that may be of assistance in understanding forensic evidence disciplines of digital forensics, arson investigation, DNA, death investigation, and more.

The National Forensic Science Technology Center created this website to explain in simplified terms the principles of each type of forensic analysis and how the analysis is performed. Topics include DNA, digital evidence, fingerprints, firearms, trace evidence, blood stains, and more.

Forensic Magazine regularly posts articles on digital forensics. Recent topics include: SIM card forensics, cell phone evidence, and collecting computer evidence.

Offers direct assistance to defense lawyers handling cases involving new technologies and tactics that may infringe on privacy rights of Americans.

Nonprofit that defends digital privacy. Website includes information on cell tracking, locational privacy, pen trap, surveillance technologies, and more.

• Cell Tracking – Considers whether the government can use cell phone records to track the physical location of a suspect without first obtaining a warrant based on probable cause.
• Printers – Discusses the practice of color laser printer manufacturers encoding of identifying information on each page printed by the machine. Explores the privacy implications of this practice.
• Revised Opinion in Privacy Case Blurs Clear Limits to Digital Search and Seizure – Discusses a 2010 Ninth Circuit case dealing with proper procedure for electronic searches.

Provides the name of the service provider associated with a phone number.

Retention periods for call details, cell tower information, text message content, pictures, and other types of data from a CAST presentation shared in a 2021 Vice article.

Search this directory of wireless and internet service providers to find contact information for legal departments. This directory was created for law enforcement use through a grant from the DOJ.

The Digital Evidence Subcommittee of OSAC focuses on standards and guidelines related to information of probative value that is stored or transmitted in binary form. 

Composed of member organizations that are actively engaged in the field of digital and multimedia evidence. Works to foster communication and cooperation and ensure quality and consistency within the forensic community.

A guide to the legal issues presented by the collection of digital evidence in criminal cases, written mainly for North Carolina judges, lawyers, and officers. This book addresses how such evidence may be obtained and the rules that govern its use in court and is available for purchase.

by Linda Volonino and Reynaldo Anzaldua – this book provides an excellent introduction to the topic. An overview of the materials is available in an online “cheat sheet.”

COA held that the defendant is entitled to face recognition information as part of requested discovery in accordance with Brady v. Maryland.

EDVA decision holding a geofence warrant was unconstitutional.

Detective testified about cell phone tower location and determined direction of tower based on records. COA held Detective’s testimony was limited to illustrating and interpreting the admitted cell phone records, therefore it did not require scientific or other specialized knowledge and was not expert testimony.

Defendant’s CSLI was searched pursuant to a court order, instead of a warrant. However, the court held that the order met the warrant requirements. Thus, there was no error and the defendant was not entitled to suppression of CSLI on Fourth Amendment grounds. 

Rule 701 allows a non-expert to testify in the form of opinion or inference where it is rationally based on a perception of the witness and helpful to the determination of a fact in issue. Testimony from a lay witness and an officer about their suspicion that the defendant used an app to conceal text messages and regarding record keeping of those messages was an error, but not plain error.

This discovery list serves as an all-in-one, cover-your-bases initial discovery checklist for many of the most commonly used categories of technology that you will see in your cases. 

Sample order for cell phone records pursuant to a discovery motion.