Digital Evidence in Criminal Cases

July 24, 2023 Don Pumphrey, Jr. Criminal Defense Social Share

When a person is suspected of a crime, the prosecution team relies on the available evidence to obtain a conviction. As technology has continued to evolve, so has the need for ways to obtain, analyze, and document digital evidence.

This page will provide information on the common types of digital evidence in criminal cases, the potential challenges they pose to investigators, possible remedies to make analyzing associated data easier, and three example cases involving digital evidence.

Nature of Digital Evidence

In a criminal investigation, both tangible evidence and digital evidence can be used to establish criminal activity.

The National Institute of Justice (NIJ) defines digital evidence as the “information and data of value to an investigation that is stored on, received, or transmitted by an electronic device.”

Further, the Supreme Court notes that modern technology results in three characteristics for differentiating standard evidence from digital evidence:

1. Digital evidence has a wider scope;
2. Digital evidence deals with both physically and personally sensitive information; and
3. Digital evidence taps into interconnected criminal justice issues that go beyond police’s typical role in collecting evidence.

Types of Digital Evidence

The following lists different types of digital evidence and the potential challenges faced in collecting, analyzing, and utilizing it:

• Internet – Some of the first traces of digital evidence came from the internet. Law enforcement can search message boards and chat rooms, file-sharing networks, downloaded items, and “Deep Web” browsers like Tor or the Silk Road. The worldwide nature of the internet can make it difficult for investigators to identify suspects because there are certain internet technologies designed to hide the identity and location of the individual who is accessing or sharing the information.
• Computers – While there is some overlap with evidence found on the internet, investigators can also find evidence on a physical computer. This includes temporary internet files, cookies, emails, and browsing history. It may also include illegal content that was downloaded to the computer’s hard drive.
• Portable Electronics – The most dominant interest in the field of digital evidence is portable electronics, specifically cell phones and other tablets. In the Riley case decision, Chief Justice John Roberts explained that cell phones are “microcomputers” that serve many critical uses for people. Cell phones have standard features for photography, GPS, internet searches, and text messaging that are distinct from other documents. The advanced power and storage provided in a portable electronic device suggest that connection with the Internet of Things (IoT)—referring to the interconnection of electronic devices to share a larger range of data—could be both a “blessing and a curse.”

Documentation of Digital Evidence

According to the NIJ, documentation of digital evidence presents two issues: (1) authentication and (2) chain of custody.

First, authentication is the process used to establish that the evidence found during investigation is indeed what the proponents claim to be.

An issue commonly found with the authentication of digital evidence is determining the identity of the author of the electronic records. For example: A defendant who is accused of sending a written threat to their coworker via email would require the prosecution to prove the defendant was actually the person who wrote and sent the email.

Second, chain of custody is part of the authentication process and assures that the digital evidence being analyzed has been preserved in its original form. It should be documented when the digital evidence was collected, where it was collected from (i.e. type, identity, and ownership), who owned the digital device, and who had access to it.

Example Cases and the Digital Evidence Impact

In the modern technological world, law enforcement relies on digital evidence more than ever before. Digital evidence can provide insight on both the suspect and victim in a criminal case. The following lists three separate investigations that highlight the importance of digital evidence.

The Case of Casey Anthony

During the high-profile 2011 murder trial for two-year-old Caylee Anthony, her mother Casey Anthony was facing allegations of first-degree murder, child neglect, providing false allegations, and obstruction of justice.

During the trial, the State argued that analyzing Anthony’s digital evidence could provide insight on whether the mother searched for information on homicide-related issues, including various methods or techniques on how to kill someone or hide a body. When police searched her Internet browser searches, it was later announced that they used software that was found to be highly inaccurate.

The investigators initially claimed Anthony searched the term “chloroform” 84 times, which was also a chemical that was found inside her vehicle. But the software designer found faults in the program and testified that the term was only searched once. The correction occurred mid-trial and may have been the reason for instilling doubt in the jury and ultimately resulting in Anthony’s acquittal of first-degree murder.

Years after the trial ended, additional evidence was discovered that suggested additional mistakes were made relating to the digital evidence in the murder case. The investigators allegedly used tools to view Microsoft’s Internet Explorer history but failed to notice that Anthony preferred to use Mozilla’s Firefox browser instead. It’s alleged that the investigators did not have information on more than 98% of the browser history records at trial, including a search for “foolproof suffocation.”

The Case of Christian Aguilar

University of Florida student Christian Aguilar went missing in September 2012 before his remains were found three weeks later over 60 miles west. He was last seen with his friend Pedro Bravo at a local Best Buy.

During their investigation, police found blood and Aguilar’s backpack inside Bravo’s vehicle. They also suspected the potential motive could be due to Aguilar dating Bravo’s ex-girlfriend.

Digital examiners received access to Bravo’s cell phone and were tasked with searching for digital evidence. Upon further inspection, the examiners found a screen shot of a Siri search through his phone’s Facebook app that read, “I need to hide my roommate.” Even though Bravo’s phone did not have the Siri feature, the record was maintained through Facebook.

There were also pings received from Bravo’s cell phone that showed he was headed far out west following Aguilar’s disappearance. Additionally, the examiners were able to determine that Bravo’s flashlight application was used for over an hour following Aguilar’s disappearance. The digital evidence was presented during the August 2014 trial and helped to secure the conviction of Bravo for first-degree murder.

The Case of Philip Welsh

Philip Welsh was a taxicab dispatcher who lacked any digital devices in his private life. He lived alone and was found beaten to death in his home in February 2014 after he did not show up for work. Welsh seemed well-liked and had no known enemies. Without any leads or traces of digital evidence, it was extremely difficult for police to find potential suspects. The case of Philip Welsh remains unsolved to this day.

Workshop on Digital Evidence Needs

In 2014, Research and Development (RAND), along with the Police Executive Research Forum (PERF), held a NIJ-funded workshop to determine the challenges associated with digital evidence in criminal cases. The workshop included a review of the resources currently available to investigators in addition to the resources that are not yet available.

The panel and research team at the workshop also identified a list of resources that could potentially improve the utilization of digital evidence in the criminal justice system. While the panel addressed 34 different needs for digital evidence, we’ve listed RAND’s top-tier of challenges along with potential digital evidence needs below:

• Prosecutors requesting all information on digital devices without considering the large quantity of data – The associated need is to expand available training for State Attorneys to build knowledge across digital device systems;
• Lack of first-responding officer’s knowledge of securing digital devices to preserve chain of custody – The associated need is to integrate digital evidence training, at least on a basic awareness level for academy training;
• Lack of department personnel to process large volumes of digital evidence that result in backlogs – The associated need is to develop better methods or prioritizing tools for what evidence to extract;
• Smaller departments that lack the capacity to address digital evidence – The associated need is to build capability and regional models to fund common resources;
• The acceptability of a digital evidence results analysis that can be challenged in court when it is not performed with the most up to date tools – The associated need is to continuously update the tools available for examiners to ensure they are using the best technology.
• Lack of knowledge about digital evidence on the judge’s part that complicated the appropriateness of its use in the courtroom – The associated need is to expand the federal-level training to build knowledge on digital evidence;
• Lack of tools to represent complex data sets in an understandable way for the investigation and presentation process;
• Volume of digital data from closed-circuit television (CCTV) cameras and video, with limited tools for evaluating and processing – The associated need is to acquire in-house tools to process video evidence; and
• The collection of data from a victim’s digital device where a broad capture would include content police don’t want, including sexting materials – The associated need is to develop tools that allow a narrower collection of data from digital devices to respect the victim’s privacy.

Benefits of Using a Digital Evidence Expert Witness

As technology continues to become more advanced with each passing year, so is the need for reliable analysis of digital evidence in criminal cases. When cases involve any potential digital evidence, it may be a good idea to hire a forensic expert witness.

The digital forensic experts at Loehrs Forensics are internationally recognized for analyzing digital evidence and translating it into compelling testimonies in layman’s terms for the legal industry.

If you hire Pumphrey Law Firm to represent your case involving digital evidence, we may recommend working with an expert witness such as Tami Loehrs who can analyze all digital data and determine if the police investigation has any holes or inaccuracies.

Contact Pumphrey Law Firm

Digital evidence can be the incriminating factor that results in a defendant’s conviction. For example, if investigators find any trace of child sexual abuse material (CSAM) on a person’s computer—even if they are certain they did not download it and that it came from a virus—it can result in a conviction and steep consequences.

As shown through the example cases above, digital evidence can determine the defendant’s guilt, result in a cold case when there is a lack of digital evidence, or issues found in the process of analyzing digital evidence can result in the defendant’s acquittal.

If you or a loved one are facing criminal charges and need legal guidance, contact Pumphrey Law Firm. Our defense attorneys can review your case details and determine if working with a forensic expert witness is beneficial to your case. Call us today at (850) 681-7777 or leave us a message on our website for a risk-free evaluation.

Written by Karissa Key

  Social Share