Overview
Courts provide little guidance on the balance between “too much” and “not enough” digital evidence needed to prove cases. The burden falls to attorneys and investigators to make decisions based on hard-to-answer questions.
Excerpt
On one hand, the volume and variety of digital data — along with the increasing complexity in obtaining it and piecing it together — is too much for many forensic labs. Months-long backlogs can lead to delays in getting the evidence to investigators and attorneys who need it for their cases. Cost constraints — not to mention the COVID-19 pandemic — compound the problem.
Courts provide little guidance on where the balance lies, so the burden falls to attorneys and investigators to make decisions based on hard-to-answer questions including:
On the other hand, a minimalist “less is more” approach to evidence hamstrings justice itself. As forensic examiners know, data — or its absence — isn’t always as it appears. It needs to be authenticated and corroborated with other pieces of evidence to put a particular user behind the keyboard (or screen) of a particular device.
Technology can solve some, but not all, of these problems. For instance, artificial intelligence can be invaluable to prioritize which of the hundreds of thousands of pictures or messages should be examined more carefully. But it can’t prove who put them on the device.
- What’s actually relevant to help build a case’s fact pattern?
- Can the evidence presented as “complete” be properly authenticated?
- How far back should a timeline go; where’s the privacy rights balance between too broad and too narrow?
- Can a jury properly weigh — and convict — based on evidence that might not be complete? (And would that conviction be upheld on appeal?)
- What does this all mean for digital forensics examiners and attorneys on a practical level?