Why Your Electronic Evidence Gets Thrown Out of Court

Summary

A documented chain of custody is one way to authenticate electronic evidence, and it is often the most practical way when the evidence has been collected forensically. Good chain-of-custody documentation supports an argument that the evidence is what the proponent says it is and has not been altered, but the court decides whether that showing is sufficient.

Chain of Custody for Electronic Evidence: A Comprehensive Guide

Chain of custody is a critical process for handling electronic evidence to ensure it is admissible in legal proceedings. It refers to the documentation and tracking of the movement and handling of evidence from the time it is collected until it is presented in court. A properly maintained chain of custody proves the authenticity of the evidence and that it has not been altered or tampered with. This is especially important for electronic evidence, which can be easily modified if not handled correctly.

Here is a step-by-step guide to establishing and maintaining a strong chain of custody for electronic evidence:

Step 1: Identify and Secure the Electronic Evidence

The first step is to identify the electronic devices, media, and data that may contain relevant evidence. This could include computers, mobile phones, hard drives, USB drives, cloud storage, network logs, and more. Once identified, the devices and media must be secured to prevent any changes to the data.

Example: In a corporate fraud investigation, the relevant evidence may reside on an employee's work computer and mobile phone, as well as the company's network servers and cloud storage accounts.

Best practices for securing electronic evidence include:

• Documenting the hardware and device details (make, model, serial number, etc.)
• Photographing the device and surrounding area
• Isolating the device from networks and wireless signals
• Using write-blockers when creating forensic copies of storage media
• Securely transporting and storing devices in anti-static packaging

Step 2: Collect the Electronic Evidence

Forensic data collection should be performed by trained professionals using industry-standard tools and techniques. This ensures the data is acquired in a forensically-sound manner that preserves the integrity of the evidence.

Key considerations for forensic data collection include:

• Documenting all steps taken and tools/settings used
• Using hash verification to prove copies are exact bit-for-bit duplicates
• Collecting ancillary evidence like network logs, access records, etc.
• Maintaining detailed contemporaneous notes
• Following the standards that apply in the forum, which in Illinois means the Frye standard for novel scientific methodology rather than Daubert

Example: A computer forensics expert may use a write-blocker and tools like FTK Imager or EnCase to create a verifiable forensic image of a computer's hard drive. A hash value is calculated to prove the copy is an exact duplicate of the original data.

Step 3: Analyze the Electronic Evidence

Once collected, the electronic evidence must be carefully analyzed by skilled examiners. All analysis should be performed on verified forensic copies of the original data to maintain evidence integrity. Examiners look for relevant files, emails, chat logs, internet history, deleted data, and other artifacts that may serve as evidence.

Important considerations for forensic analysis include:

• Maintaining professional certifications (CCE, EnCE, GCFA, etc.)
• Documenting all findings and investigative steps
• Using industry-standard analysis tools and techniques
• Validating the software and tools used, and documenting that validation
• Preserving analysis copies of data

Example: A certified mobile phone examiner may use Cellebrite UFED or Magnet AXIOM to extract and analyze data from a smartphone. Detailed reports document the tools used and all relevant findings like texts, call logs, photos, app data, and location information.

Step 4: Document and Track the Electronic Evidence

Throughout the entire lifecycle, the chain of custody for the electronic evidence must be carefully documented. This includes tracking who has handled the evidence, when, and for what purpose. Physical and digital chain of custody forms should be used to document the transfer of evidence between parties.

Best practices for evidence tracking include:

• Using standardized chain of custody forms and labels
• Storing evidence in a secure location with restricted access
• Requiring signatures for all evidence transfers
• Implementing an audit log for evidence access
• Regularly reviewing chain of custody records for accuracy

Example: When a computer forensic expert transfers a hard drive to a law firm, both parties sign and date a chain of custody form. This documents exactly when the drive was transferred and who took possession of it. The drive is stored in a secure evidence locker that requires badge access to enter.

Step 5: Present the Electronic Evidence

If the electronic evidence is presented in court, the chain of custody documentation will be used to prove its authenticity and reliability. The forensic examiners involved may be called to testify about their analysis methodology and findings.

Important considerations for evidence presentation include:

• Providing a thorough, understandable explanation of the evidence
• Being prepared to explain tools, techniques, and forensic artifacts
• Demonstrating that industry best practices were followed
• Showing that evidence integrity was maintained at all times
• Addressing challenges to the evidence's admissibility

Example: In a trial, a computer forensics expert presents their findings and the supporting chain of custody documentation. They explain the EnCase forensic software used, the process for creating a verifiable drive image, and the hash values that prove the authenticity of the evidence. The solid chain of custody demonstrates the evidence is trustworthy.

Conclusion

Properly establishing and maintaining chain of custody is essential for electronic evidence to be admissible and convincing in court. By carefully identifying, collecting, analyzing, tracking, and presenting digital evidence, legal and forensic professionals can ensure critical information is available to prove or disprove a case.

A well-documented chain of custody proves that best practices were followed and that the electronic evidence is authentic and reliable. Gaps in the chain of custody usually go to how much weight the evidence is given rather than whether it comes in at all, but a complete failure to authenticate can keep the evidence out.

It is crucial that all parties handling electronic evidence in an investigation or legal matter understand and strictly adhere to the chain of custody procedures. This protects the integrity of the evidence and the outcome of the case.

References

Related Articles

• Digital Device Seizure Protocols
• Privacy Protection During Divorce Proceedings
• The Digital Divide: Navigating Forensic Data Recovery in Family Law Cases

Written by Jonathan D. Steele

Chicago divorce attorney with cybersecurity certifications (Security+, ISC2 CC, Google Cybersecurity Professional Certificate). Illinois Super Lawyers Rising Star 2016-2025.

Request Conflict Check

For more insights, read our Divorce Decoded blog.