When digital evidence is required at the start of a matter, it's easy to get swept up in the moment and start rushing to gather the evidence but this is a key time to step back, take a moment and reflect on the ultimate aim.
Self-collection is your firm's greatest value proposition. The Client can gather the digital evidence, send it through and then it can be reviewed so it is possible to start piecing together what has occurred. However, this can result in potentially more work, missing key evidence or receiving a biased version of evidence and, of greater concern, having key evidence inadmissible in Court.
Here are some common scenarios to illustrate. The Client states that all the evidence relating to the claim is located on a particular folder on their Desktop, in text messages on their phone and within a folder in their email inbox. The Client will then copy the files from their Desktop onto a USB drive and forward emails that are located in their specific folder in their inbox.
The process of copying files onto a USB has the potential to change metadata. This could mean that the file creation data, modification date or accessed times could change which could create doubt in terms of the authenticity of the documents. This process is also focused on what the Client believes to be relevant to the claim from a document perspective. There could be other data located on their computer that relates to the claim that they would not be able to access. This could include deleted data which could be recovered utilising forensic techniques, internet history, system artefacts, evidence of distribution of the key data or inculpatory evidence that needs to be considered.
In relation to emails, similar to copying files, the process of copying emails to a USB or forwarding the email to yourself may result in modification of the metadata. The folder may contain all received emails relating to the matter however may not include all sent items. If your Client has performed searches across their email to identify keywords that would relate to the matter, non-text searchable documents will be missed such as PDF attachments.
For mobile phones, self-collection is difficult and, in most instances, Clients will take screenshots or photos of their screen with the relevant text messages. Similar to documents and emails, this is a biased view of the conversations that have occurred and may not consider alternate communications that have occurred using other chat providers. Screenshots and photos will not have the associated metadata so the messages themselves cannot be verified in terms of when and if they have occurred.
Early engagement of a Forensic investigator will ensure that all potential data sources relating to the claim are identified and considered for preservation and collection. They will utilise methods that will ensure the evidence identified is admissible, impartial, repeatable and defensible in Court. They will ensure integrity of data and maintain full Chain of Custody from identification through to finalisation and, where required, they will prepare and present expert testimonial evidence in Court.
