1. Digital evidence Stephen Mason, Barrister Visiting Research Fellow
Director, Digital Evidence Research Programme
2nd Annual Workshop on Digital Forensics & Incident Analysis
27 August 2007
University of the Aegean, Samos, Greece

2. Outline Electronic evidence (analogue & digital) Forms of evidence
Authenticity of digital evidence

3. Analogue
Examples:
vinyl records, audio tape, photographic film, telephone calls made over the public switched telephone network, the reading of a radar

4. Digital
Examples:
anything that has been created or stored on a computer or computer like device, or is made available by way of the internet, including CDs, DVDs, MP3s and digital broadcast radio

5. Evidence Forms of evidence Admissibility Weight
Direct and indirect evidence
Real evidence
Best evidence
Primary and secondary evidence
Admissibility
Weight

6. Laying the foundations
In re Vee Vinhnee, Debtor American Express Travel Related Services Company, Inc. v Vee Vinhnee 336 B.R. 437 (9th Cir. BAP 2005)
American Express claimed Vinhnee failed to pay credit card debts, and took action to recover the money
The trial judge declined to admit the plaintiff’s computerized business records
American Express failed, when offered the opportunity, to rectify the lack of evidential foundations

7. The records were not adequately authenticated at trial

8. The witness Was not sufficiently qualified
Did not have the requisite degree of expertise in a range of areas relating to:
The nature of the computer equipment, and
The software

9. Technical and organizational issues
There was no evidence that the business conducted its operations in reliance upon the accuracy of the computer in retaining and retrieving the information in question

10. Pertinent observations
The primary authenticity issue in the context of business records is on what has, or may have, happened to the record in the interval between when it was placed in the files and the time of trial
In other words, the record being proffered must be shown to continue to be an accurate representation of the record that was originally created
The focus is on the circumstances of the preservation of the record during the time it is in the file, to provide assurance that the document being proffered is the same as the document that was originally created

11. The building blocks
Evidence may be required to demonstrate that the record is what it purports to be
Pertinent points to determine whether records have been changed since their creation include:
Relevant policies and procedures for the use of the equipment, database, and programs
How access to the pertinent database is controlled
How access to the specific program is controlled
How changes in the database are logged or recorded
The structure and implementation of backup systems and audit procedures for assuring the continuing integrity of the database

12. Framework for authentication
The evidence needs to be assessed with respect to:
Reliability
Integrity
Trustworthiness
Each of which can provide for the authenticity
Which in turn needs to take into account:
The machine
Operating and Application software
Storage medium
Retrieval
Alteration and detection of alteration
Management of dependencies

13. State of Connecticut v Julie Amero (2007)
Criminal proceedings
State of Connecticut v Julie Amero (2007)
What went wrong?
Answer: what was undertaken correctly?
Police expert
Prosecution
Defence
Judge

14. In summary
The content of the data that a party relies upon has not changed from the moment it was created to the moment it is submitted as evidence
The data can be proven to be from the purported source
The technical and organizational evidence demonstrates the integrity of the data is trustworthy, and is therefore considered to be reliable

15. Stephen Mason Main publications:
Electronic Evidence: Disclosure, Discovery & Admissibility, (LexisNexis Butterworths, 2007), Author & General Editor
Electronic Signatures in Law (Tottel, 2nd edition, 2007)
, networks and the internet: a concise guide to compliance with the law (xpl publications, 6th edition, 2006)
General Editor of the Digital Evidence Journal