co-authored by Jared Barnhart, Customer Experience Team Lead, Cellebrite
With nine out of 10 people owning a smartphone and 97% of Americans having a mobile phone of some kind—we are all leaving a digital trace. With this interconnectivity, it’s now nearly impossible to find a crime committed today that does not involve a digital component. And more and more, we are seeing juries expecting to hear the digital evidence in a case.
Telling a Story in Plain Terms
When juries hear a case, it’s imperative they can easily grasp a simple explanation of the chain of events. Timelining a visual representation in terms a jury can understand helps them visualize each event. This way, when prosecutors cross reference devices and visually display them in concert, they’re connecting a device at a scene with a specific time for the jury.
For example, in a multiple armed robbery investigation that involved forceful violence in various convenience stores in Maryland, police had to demonstrate how the crimes were connected. First, a license plate led investigators to a person and his phone records. From there, police mapped out where the device had been at the time of the crime and to whom the person was talking.
When the case went to trial, there were crimes at five different locations in question. As the defense worked their hardest to poke holes, the prosecutor underscored to the jury that these people either had the worst luck in the world or they were part of related crimes.
Reinforcing the Story through Pattern of Life
Whether it’s a suspect or victim’s device, the pattern of life conversation is what builds the story. By going back in time and establishing a pattern of normal activities, it is easy to convey unusual or even suspicious activity. Paint a picture of the day of a crime and be prepared to point out how it was different from the normal pattern of life. Where did they go? What did they search? Why did they turn on their flashlight? Why did their health data fluctuate – or not? Putting behavior to a digital fingerprint helps juries understand the story.
Avoid Getting into the Data Weeds
Given its complexity, digital forensics pros and the prosecutors questioning them should avoid trying to explain binary code to the jury. Digging into the 1s and 0s and the way data is physically recorded and stored programmatically likely won’t benefit a case. Instead, approach data in simple terms.
Take deleted data, for example. Explain that examiners look for the start and ending of a file and can tell when data is deleted. Instead of trying to explain the code, speak to the content: the data showed it was a recovered deleted text message. Perhaps it’s health data, which showed the heart rate was recording until this time, after that, the heart rate was at zero. Demonstrating what the jury would see if they looked at their device helps them better understand the evidence.
Knowing the Report
Knowing the case inside and out is critically important when it comes to presenting to a jury. Jurors watch both the prosecutor and the expert’s comfort level on the stand, so knowing, understanding and quickly interpreting the report is paramount. Both should be aligned on the strategy to adequately communicate the content to the lay person on the jury.
To that end, how you generate a report is important. It must be readable, even to a novice’s eye. After all the work that goes into getting a case right, avoid leaving any room for a jury or the defense to question one’s professionalism and expertise. Recently, Cellebrite did a webinar on reporting best practices: I Beg to DFIR: Mastering the Art of Proper Reporting.
Collaboration with Examiners
Too often, an investigator does not validate the information with an examiner and testifies to a report they do not fully understand. And sometimes it’s the prosecutor not fully up to speed. Proper collaboration and consultation with a digital forensics examiner will avoid issues. Validating and confirming information in the report with an examiner is an essential part of the process.
Preparation is key. The attorney, investigator and digital forensic examiner should be aligned on how to accurately explain the digital evidence being presented in the courtroom. Ensuring this level of alignment, understanding and confidence, prosecutors can most effectively pursue a just verdict.
About the Authors
Heather Mahalik Barnhart is the Senior Director of Community Engagement at Cellebrite, a global leader in premier Digital Investigative solutions for the public and private sectors. She educates and advises digital forensic professionals on cases around the globe. For more than 20 years, Heather’s worked on high-profile cases, investigating everything from child exploitation to Osama Bin Laden's digital media.
Jared Barnhart is the Customer Experience Team Lead at Cellebrite, a global leader in premier Digital Investigative solutions for the public and private sectors. A former detective and mobile forensics engineer, Jared is highly specialized in digital forensics, regularly training law enforcement and lending his expertise to help them solve cases and accelerate justice.