co-written by Page McBeth, Customer Success Manager, Cellebrite
Juries are catching on when it comes to digital evidence—some have even come to expect a digital footprint to convince them beyond a reasonable doubt the accused committed a crime. Any investigator who’s been working cases long enough knows the feeling when you find that key piece of evidence that can close your case. Now imagine learning it won’t stand up at trial—a nightmare scenario for any law enforcement professional.
Case in Point in Oregon
In Oregon, a man faced more than 100 counts of encouraging child sexual abuse, a first-degree felony in the state. That specific charge had a six-year statute of limitations. Prosecutors did not elect to charge him with possession of the material. Two weeks before trial, as prosecutors prepared, they realized the date and time stamps all were outside of the statute of limitations, which resulted in the dismissal of 100 counts of encouraging child sexual abuse in the first degree. Fortunately, the suspect faced other related charges and was ultimately locked up.
In another case involving child sexual abuse material, the key evidence was cached images. Since there were no date and time stamps, it is tricky to determine how they got on the device, which resulted in delayed justice.
These examples underscore the need for collaboration across an investigation’s life cycle, so investigators and prosecutors have a full understanding of the evidence’s value to a case. When you look at a criminal investigation from a 50,000-foot view, it’s easy to thoughtfully lay out best practices and how an ideal investigation will go. In reality, things move quickly. When collaboration between a digital forensics unit and investigation unit takes a back seat in the flurry of activity in a case, things can and will go awry.
Mapping the Digital Trail
The investigative tools out there are getting so good, sometimes investigators can take for granted grasping the importance of the digital trail. A great piece of evidence, those key events or artifacts which sure up a case, are only helpful if you can pinpoint exactly where the data came from and what the data actually means. For those of us who train in best practices in digital investigations, we regularly come across investigators who cannot pinpoint a data point’s source and how it fits in the case. That information is ultimately what you will need at trial for the jury to trust you.
It's imperative that investigation units understand that in whatever evidence they do find, they have to go back to the forensic units to validate and verify the information they are using to advance a case. In any profession, communication is the driving success factor. Communication should consistently be open-ended between the Digtial Forensic Units and the Investigation Units until the case is closed.
Validating the “Smoking Gun”
We work hard to educate both analysts and investigators that the “smoking gun” piece of evidence must be taken to a forensic examiner. It sounds like basic police work, but it’s important to know who, what, where, when, why and most importantly, how it got there so you can stand strongly and firmly behind the digital evidence in court. This will greatly improve your credibility in the courtroom, leaving little room for the defense to question your methods and undercut your professionalism.
There are some investigators and prosecutors who are very advanced and their understanding of computer or mobile device forensics. They take the time to talk with the examiners and listen. Prosecutors and investigators who have limited forensic experience must open the lines of communication. The fact checking of the smoking gun lies with the forensic examiner, who can determine the data’s source, which will determine digital evidence’s role in the case.
Establishing rapport with everyone who touches an investigation comes down to a culture shift. Fostering an environment of collaboration means building it into how you develop a case. It needs to be mandated that investigators confer with the trained and certified forensic examiner to help guide the process. Before anything is submitted a prosecutor, have a conversation with your examiner. Sit down together and make sure your case has a solid foundation to ensure justice is served with the final swing of the gavel.
About the Authors
Heather Mahalik Barnhart is the Senior Director of Community Engagement at Cellebrite, a global leader in premier Digital Investigative solutions for the public and private sectors. She educates and advises digital forensic professionals on cases around the globe. For more than 20 years, Heather’s worked on high-profile cases, investigating everything from child exploitation to Osama Bin Laden's digital media.
Page McBeth, a Customer Success Manager at Cellebrite, helps law enforcement professionals understand how to leverage digital investigative solutions, particularly Cellebrite Pathfinder, to connect the dots in criminal cases. A veteran of the Oregon Internet Crimes Against Children Task Force, Page's 30-year career helped countless children and secure the convictions of dozens of offenders.