Most readers familiar with common law will be aware of some of the free legal resources on the Internet. Additional links can be found on any University Library website, including the Institute of Advanced Legal Studies, London website.
Proof: the technical collection and examination of
Guidelines for the search and seizure of evidence in
Finally, before my learned friend answers, we must consider the requirement that the book be in the custody or control of the bank. But as one edition followed the other, the size of the text increased (the first edition included 551 pages, the second 812 pages, and the third edition 934 pages).
Digital devices
Nor is it intended to be a comprehensive review of the devices and technologies that create electronic evidence. Rather, the goal is to provide a broad introduction to the relevant technical issues and to highlight features that a digital evidence professional and a legal professional should be concerned about when examining electronic evidence and addressing electronic evidence issues.
The processor
The purpose of this chapter is to introduce the reader to the technologies, their underlying principles and the general characteristics that distinguish digital evidence from analog or physical evidence. The contents of this chapter do not go into any of these matters in detail.
Software
We must also take into account that the clock in digital devices is often inaccurate (as in a cheap wristwatch). Such inaccuracy can affect both of the above uses of the watch, ie. to event scheduling and logging, as both aspects may depend on time derived from the system clock.
Memory and storage
Data storage facilities
But data can also be stored remotely, such as to network-attached storage, remote networks, or cloud facilities. Of concern to many digital investigators is the inherent difficulty in finding and obtaining legal access to data that is stored remotely from an individual's computer.
Lost data
Data formats
Starting a computer
Types of evidence available on a digital device
Files
Imaging
System and program logs
Temporary files and cache files
He should only have been convicted of knowingly putting the pictures in the J catalog because he knew what he was doing. Depending on the application and the exact circumstances, some applications may allow unencrypted copies of the data to be stored in the swap file.
Deleted files
He was acquitted of a further 24 charges, some of which related to the files deliberately stored in the J directory. The court ordered that the case be remanded with an order to convict Dr. Atkins of the offenses of deliberately storing photographs in the J directory.2.
Mobile devices
This is illustrated by the case of Sectrack NV v Satamatics Ltd2 regarding misuse of confidential information. When the device was 'unlocked', it automatically downloaded several emails that the suspect received, linking him to misuse of confidential information.3 Since this case, portable device manufacturers have developed extensive backup systems that allow device data to be backed up to other devices and storage facilities.
Networks
Types of network Internet
Extensible Authentication Protocol Method for Global System for Mobile Communications (GSM) Subscriber Identity Modules (EAP-SIM)' (2006) RFC 4186
Types of network applications Email
However, the SMTP server may keep a log of messages passing through the system. The software then allows other clients to access the computer's resources over the network.
Concluding remarks
As social networks have grown in popularity, with the meteoric rise of participating users, several contexts arise in which the content of an individual's contribution to the social network may constitute evidence. If an individual had made such contributions under a pseudonym, a digital evidence professional may be able to determine their true identity by matching their online contributions to the same content found on the individual's storage media.
The characteristics of electronic evidence Burkhard Schafer and Stephen Mason
However, the definition of electronic evidence is limited to those items provided by the parties as part of the fact-finding process. Consequently, electronic documents are a particularly important form of electronic evidence.1 They are also a particularly good example to illustrate some of the relevant characteristics of electronic evidence.
The dependency on machinery and software
Some of the recordings were made on tapes looking for cars no longer in the club's possession. Report by Bob Sherwood, "Ronnie Scott's Jazz Club to release archive of greats", Financial Times (London, 28 June 2006) 1.
The mediation of technology
We know that different observers of the same event will always provide subtly different accounts of what happened. Furthermore, an observer will inadvertently and inevitably change his memory of the events each time he tries to recall them.
Speed of change
The comments of Hallett LJ, delivering the court's judgment, illustrate the naivete in the prosecution's forensic investigation of the data. We can understand why evidence of the use of phones at the cell site was of limited value given the proximity of the poles, the various scenes and the homes of those involved.
Volume and replication
In addition to the sheer volume of this data, an additional problem is that it is incomprehensible to humans in its raw form - most of the data is instructions sent between and for use by other machines. Business data may be processed using “cloud computing” technology, where the data is outsourced to third-party servers that are not owned and operated by the company and may be located around the world, with each server holding only portions of the data at all times.1 On the other hand, the automatic uploading of data also means that the user of a device loses control over the information they created.
Metadata
Interpreting them requires the need to make assumptions about the environment in which they were created. Since the environment can 'lie' in this sense, informed criminals can deliberately manipulate the data.
Types of metadata
Unlike staff, they are not employees of the applicant, but volunteers who do not work in the office or use computer systems belonging to the applicant. In the case of Armstrong v. Executive Office of the President, Office of Administration1, researchers and nonprofit organizations challenged the proposed destruction of federal records.
Social context and metadata
His appeal to the Crown Court in Doncaster was dismissed and on further appeal the question was whether the words he used were a 'menacing message sent through a public communication medium' and therefore contravened s 127(1)(a) and (3) of the Communications Act 2003. The visual form in which this evidence appears may not be a true version of the social meaning that the information created.
Storage media
An intellectual framework for analysing electronic evidence
The defense can claim that the computer was bought second-hand and the image came from the previous owner. Several studies have shown, with examples, how this analysis can help evaluate heterogeneous evidence, from eyewitnesses to DNA.1 The nature of digital evidence, as our claim suggests, is that in a like-for-like comparison and allowing for the machine-mediated nature of electronic evidence, the evidence will be several steps further away from definitive probandum when compared to traditional evidence.
The foundations of evidence in electronic form Stephen Mason and Daniel Seng
Direct and indirect evidence
Evidence in both digital and analogue form
In a carefully reasoned judgment, Morse J set out how the system worked, finding that the computer terminal used by the police generated each e-ticket with simplified traffic information for the accused, printed duplicate originals of the e-ticket and affixed the arresting officer's electronic signature to the e-ticket. It was revealed that the camera technician carried out a secondary check to confirm the speed of the vehicle on the digital files of the photographs.
Metadata and electronic evidence
The evidence was also available in digital form, and the defense argued that digital data should be disclosed in the same way as printed photographs. The judge stated that the photographs were real evidence - they showed the times the vehicle traveled over a number of pre-measured lines drawn on the road - and that using all this information it was perfectly possible to conduct a secondary check from the photographs themselves.
Means of proof
Although there were minor format differences such as the color and the number of sides the e-tickets were printed on, these differences were not sufficient to convince the judge that the e-tickets were substantially similar to a paper ticket. For this reason it was found that whether the digital data was disclosed to the defendant was irrelevant.2.
Testimony and hearsay
Real evidence
1 Daniel Seng and Sriram S Chakravarthi, Computer Output as Evidence – Consultation Paper (Singapore Academy of Law available at Evidence in analogue form 2 The members of the Court of Appeal in Northern Ireland followed this line and admitted a copy of a transcript as genuine evidence in Public Prosecution Service v Duddy [2008] NCIA NI 19. The evidentiary status of transcripts is no different to a photocopy of a forged cheque.2. In this case, an advertisement contained in a teletext broadcast was considered a document for the purposes of the Betting and Gaming Act 1981. Calvert Smith J also concluded, in Kennedy v Information Commissioner,6 that the word 'document' in s 32 of the Freedom of Information Act 2000 includes information recorded in an electronic medium. It seems to us that the essential essence of a document is that it is something relating to recorded information of some kind. In R (on the summons of Leong) v DPP,3 Silber J applied the analysis of Richards LJ, considering the oral evidence of the police officer's reading from a transcript admissible: "Where, as in the present case, there is evidence that the machine is working properly, there is no reason why the police officer concerned cannot give admissible evidence of what he saw in the transcript."4. 2 Section 69 of the Police and Criminal Evidence Act 1984 was repealed by section 60 of the Youth Justice and Criminal Evidence Act 1999, although the relevant case law remains useful authority. Minor typographical errors on the transcript do not alter the validity of the results: Reid v DPP, The Times, 6 March QB). Eyewitness accounts should not be dismissed because the best evidence was not available. The decision of the Court of Appeal in Masquerade Music Ltd v Springsteen,1 suggests that the best evidence rule is irrelevant. On appeal, the Court of Appeal was concerned that the secondary evidence had insufficient weight to prove the exact amount of the claim against the defendant. For this reason, the fundamental unfairness should have led the court of first instance to conclude that the amount of the debt was not proven and that the defendant's appeal was allowed. Although the metadata may have been changed, the content of the file in question has not been affected. If the contract is then printed and signed by the authorized representatives of the two parties, the original document will be the printed version. Two identical copies of the monthly statement were printed, one for the customer and one for the bank. The bank kept its copy of the monthly statement, but did not keep a record of the transactions. In other words, where the credibility of the digital data is at stake, basic evidence, usually in the form of testimony, will need to be entered and tested to determine whether the secondary evidence can be accepted as 'a copy' of the original document. This undermines the role of judicial control, as explained above, and also undermines the judicial assessment of the proof of authentication with regard to the true accuracy and reliability of the secondary evidence. Thus, when referring to digital data, it may be more relevant to concentrate on establishing which version of the data is required, in particular whether the production of copies of the digital document is properly documented. 4 In R v Caldwell, R v Dixon (1993) 99 Cr App R 73, 78 the members of the court believed that it would be useful to have a set of procedures relating to the use of video footage for the purpose of identification. 32.1 (1) The court may control the evidence by giving directions about— (a) the matters about which it requires evidence. Furthermore, to summarize to the members of the jury at the end of the trial, the judge is required to give directions on a number of issues, including but not limited to: who has the burden of proof; what presumptions, if any, apply; when supporting evidence should be considered before weighting certain types of evidence; and to make comments on matters including the weight of the evidence, although it must be made explicit that such comments are intended to assist the members of the jury as they must reach their own decision.1 In addition, there are a number of factors set out in s 114(2) of the Criminal Justice Act 2003 which deal with the assessment of the weight of hearsay in criminal cases. Alternatively, in accordance with the provisions of Article 7(1)(b), the certification by a person of such electronic signature is admissible as to the authenticity or integrity of the communication or data. 1 See Mason, Electronic Signatures in Law, for a comprehensive overview of the various forms of electronic signatures and case law. How IT law false friends can confound lawmakers: an Italian tale about digital signatures' (2009) 6 Digital Evidence and Electronic Signature Law Review 80. This may require the submission of evidence such as extrinsic evidence to demonstrate that the electronic signature determines one or more aspects of the authenticity or integrity or both of the electronic document of the Communication 15(02), as set out in 1502. 5 As pointed out by Ugo Bechini, a 'handwritten signature links a document to a person, while a digital signature does not: it links a document to an entity' (Ugo Bechini, 'Bread and donkey for breakfast. It was only after these two grounds were satisfied that the identification evidence of the application of the technique was admitted. The trial judge declared the testimony of the police officers and the transcripts of the recording admissible and placed the evidence before the jury. Elkins (ed), Visual Literacy in Action (Routledge Damian Schofield, 'The Use of Computer-Generated Images in Court Proceedings' (2016) 9 Digital Evidence and Electronic Signature Law Review 1. David M. Paciocco seems to have missed this serious issue when he commented that the introduction of computer-enhanced photographs did not require any specific evidentiary basis or relevant expert evidence: 'Proof and Progress: Coping with the Law of Evidence and the Canadian Journal of Law and Technology of the Technological Age 181, 186–7. David M Paciocco seems to have missed this serious issue when he comments that the introduction of computer-enhanced photographs did not require any particular evidence base or relevant expert evidence: "Evidence and Progress: Confronting the Law of Evidence in a Technological Age Canadian Journal of Law and Technology". 1 Charles Macdonald, 'Case Note Owners of the Ship Devotion v Owners of the Ship Golden Polydynamos'. 1995) 4 Int ML 77 where members of the Court of Appeal approved the trial judge's comments regarding the use of computer simulations as evidence of a collision. 3.101 These lessons can be illustrated by the case of R v Ore, which introduced one of the first forensic computer-generated animations to an English criminal case. The Crash Investigation and Training Unit of the West Midlands Police Service produced the animation. First, a distinction must be made between statements that may be hearsay and evidence that does not meet the definition of hearsay, the latter resulting in the evidence being treated not as hearsay but as real evidence. In the latter case, where raw data is entered into a program and then processed by digital means, the resulting apparent statement may not qualify as a statement under the hearsay rule. See also Edmund Morgan, 'Hearsay dangers and the application of the hearsay concept Harv L Rev 177; Laurence H Stam, 'Triangulating hearsay Harv L Rev 957; and Michael H Graham, 'Stickperson hearsay: a simplified approach to understanding the rule against hearsay' (1982) 4 University of Illinois Law Review 887. In reforming the application of the rule, these jurisdictions reconsidered the foundation of the hearsay rule by refocusing the rule and rationalizing the multitude of exceptions that had proliferated. 1 For discussion of the basis of this right and its modern legitimacy, see Mike Redmayne, . A brief examination of this trial reveals valuable insights into the meaning and intent of the right to confrontation as enshrined in the United States Constitution. If the claim is the product of automation, software computation, or predictive logic, it cannot be said to be a claim within the meaning of the rumor rule on the basis of this justification. There is no way for a human agent to make the statement to the court because no human was responsible for the communication. For all other evidence, the hearsay rule applies with its board's application of the reliability exception. The judge also failed to consider the reliability of the statement that the appellant was a member of the OC. The prosecution had no evidence of the IP address from which the material was uploaded. He should also have asked if the prosecution could call the maker of the statement and if not, why not. The wording of condition (ii) shows that Parliament provided that courts would draw inferences about the personal knowledge of the person providing the information of the matters dealt with. The defense accepted that the provisions of s 117(2)(a) had been complied with, but argued that for each record of the appellant's previous conviction, s 117(2)(b) required that the statement be obtained from each complainant as the person concerned, rather than the police officer who actually recorded the information. The ISP admitted that this information could have been provided by the holder of the email account impersonating the complainant. On appeal, Thomas LJ held that the judge's failure to explain the use was a material misdirection, as the jury could have used the ISP's email to link the appellant to the email account. The prosecution produced this e-mail to show the address of the place (appellant's home) where the police raid took place, not to prove the fact that the account was the appellant's or that the appellant was using it. (In fact, no evidence of offensive images of children was found on appellant's computer, although there was evidence that appellant's resident used an email account.) The judge gave no instruction as to the limited purpose for which the ISP's email was alleged. 1 If the National Police computer printout was properly admitted into evidence, all the conditions under s 117 being met, see R (on the Wellington claim) v DPP [2007]. The source code or assembly code cannot be used directly in the computer, and must be converted into an object code, which is 'machine readable', i.e. And as mentioned, it is also possible to reconstruct the mnemonics in the source code. A human can prove that he perceives the precise location of the mercury against the scale at a specific time and date. The witness could be challenged as to the veracity of his recollection without questioning the accuracy of the instrument. This does not mean that the authentication removes the fact that the document was created and remains stored on the device. In this case, British Gas sent letters to the plaintiff which the court found amounted to unlawful harassment in breach of the Protection from Harassment Act 1997. In the words of Jacob LJ: 'British Gas says it has done nothing wrong; that it is perfectly fine for it to treat consumers in this way, at least if it is all done by computer'.2 Jacob LJ went on to suggest that he did not follow the reasoning of Martin Porter QC, counsel for British Gas, that '[t]he correspondence was computer generated. An excuse which has been part of British Gas's legal argument to strike out the claim, and which has been put forward as unassailable and conclusive, is that a large company such as British Gas cannot be held legally responsible for errors made either by its computerized debt collection system or by the staff responsible for programming and operating it. Algorithms in spreadsheet programs are a good example of how program code affects the truth of a statement. The calculations performed by the computer were performed according to the instructions of the person who wrote the program code. Challenging the code to challenge the truth of the statement The presumption that computers are ‘reliable’ Experience also shows that they are seldom completely accurate, but usually so accurate that people continue to use them, and, barring a degree of inaccuracy, they act upon them.4. They are not necessarily accurate, and probably most such instruments, if tested properly, will reveal some degree of inaccuracy. In comparison, the members of the Divisional Court in Melhuish v Morris3 allowed an appeal against speeding because the speedometer of the police vehicle had not been tested for accuracy.4 The court in Nicholas v Penny5 subsequently reversed this decision. The instrument used to test the tire pressure was tested in March of the previous year, and in August of the year following the lecture. In Canberra it is not possible for every child to check his wooden ruler with a standard meter, nor for every grocer to check his scales with a standard gram. Judicial notice eliminates the need to provide evidence of facts that are clearly uncontroversial or reasonably arguable. Fortunately, we can take legal notice that the tack was automatically generated by the Google Earth program. I can guess, from the derivation of the name, what the instrument is, but my guess is not proof.2. Although the court heard their testimony regarding the accuracy of the satellite navigation system, it concluded that it was not necessary to rely on the satellite navigation system as in the "notorious" class and accepted the radar and sextant evidence instead. Such a presumption cannot operate in a vacuum, as indicated by Stephen Brown LJ's preference for the above formulation in Cross on Evidence which requires that the basic fact – proof that the instrument is unique which is generally known to be more often than not in working order – must be established before the presumption could operate, contrary to the same formulation of the presumption in Ph1. In the judgment of the court, May LJ stated that the 'Intoximeter ought to have been assumed by the justices to have been in good working order unless the contrat was proved'.2 When counsel for the prosecution quoted from the fourth edition of Cross on Evidence:3 'In the absence of evidence to the contrary' cell was omitted to cite the basic fact that. He also provided no evidence of what he meant by "proper operation" or "proper setup". 1 George L Paul, Fundamentals of Digital Evidence (American Bar Association Gordon v Thorpe [1986] RTR 358 where two experts gave evidence of the accuracy or otherwise of a Lion 3000 Intoximeter. In other words, that the instrument cannot capriciously alternate between giving accurate and inaccurate readings, with the accurate reading of arbitrary and incorrect lengths. The court held that the evidence provided by the operator of the device was sufficient for the court to assess the accuracy of the evidence. Questions were asked about the reliability of the software and its proper use by the officer. 1 This is a criterion that ignores how often people believe something that is not reliable simply because they are never tempted to challenge its results and examine them rigorously enough to be able to tell if they are correct. In most cases, the fault first causes a fault in the service state of the component, which is part of the internal state of the system, but the external state is not immediately affected. The bank can provide a printout of the internal workings of the machine, which shows the balance of cash in the machine before and again after the transaction. In order for the bank to prove that the machine actually dispensed £100 (and therefore the customer is lying), it is necessary for the bank to balance the ATM and report the results for the relevant time. Unauthorized use of bank cards with or without PIN code: a lost cause for the customer Digital Evidence and Electronic Signature Law Review 95; Stephen Mason, 'Electronic Banking and How Courts Approach the Evidence Computer Law and Security Review 144. 3 Michael Schloh, Baggage System Analysis of Denver International Airport (Department of Computer Science, School of Engineering, California Polytechnic State University 1996), available at Ariane 4 has different flight characteristics in the first 30 seconds of flight, and exception conditions were generated on both inertial guidance system (IGS) channels of Ariane 5'. 1 1 Nancy G Leveson, 'Software and the challenge of flight control' in Roger D Launius, John Krige en James I Craig (reds), Space Shuttle Legacy: How We Did It and What We Learned (American Institute of Aeronautics and Astronautics 2013). Mössinger, “Software in Automotive Systems IEEE Software 92; Stephen Mason, "Vehicle remote keyless vehicles systems and engine immobilisers: don't believe the insurer that they are perfect Computer Law and Security Review 195, which predicted that the number of stolen vehicles with keyless entry systems will increase, for which see Carnegie Menon, "Hi-tech thieves add computers to crowbars", The Guardian (London, 25 June 2016) 49 and "Is your car the most stolen model in England and Wales u?'. 1 “All systems go down: why big companies like Delta are finding it so difficult to debug their IT systems”, The Economist (London, 13 August 2016) (from the print edition) at Input data flaws Operational errors Professor Thomas notes, “The most important way software developers ensure the quality of their work is through testing, even though computer scientists have been saying for 40 years that testing can never prove software is safe or correct.”1 Even for relatively small systems, the number of possible test cases required for extensive testing is enormous. The number of variations is, in practical terms, limitless because a robust test must take into account, among other things, different data values, the number of concurrently running tasks, the configuration of the system memory, the hardware configuration, any connected devices or systems, the actions of the operators, user errors, data errors, device failures, and so on. These errors can be introduced during the development of the system by a developer or during use by an external third party. A software project can fail in part due to a combination of the failure of management, an unrealistic time frame to develop the software, and a failure to properly develop and test software. In the present case, on the other hand, once the software is fit for its purpose, it remains fit for purpose. Moreover, in the current state of knowledge, it is very difficult to predict the probability of failure in complex hardware and software configurations; thus, redundancy is an important design concept. 6.101 At this point, the reader may think that such problems can be solved relatively easily – by introducing anti-virus software (this is not to say that all attacks are through the use of malicious software). The New York Times relied on a Symantec antivirus product, which found only one element of the malicious software. On the other hand, not finding defects does not mean that there are no defects in the software as well. 2 Jim Nindel-Edwards and Gerhard Steinke, ‘Ethical issues in the software quality assurance function’ (2008) 8 Communications of the IIMA 53, 54. iv) external oversight to prevent errors of reasoning – this includes processes such as third-party code review.5. Writing software that is free of faults 6.106 In other words, good quality testing can detect developer errors but is less capable of solving problems in the overall design of software: There are significant limits to testing. The manufacturer submits its product to an independent authorized laboratory for an assessment of the product. This means that almost all design decisions in mechanical devices 'collapse' due to symmetries, and there is not the exponential growth of cases that occurs in software. 6.114 In particular, it may be obvious that the behavior of a stopwatch used by a police officer is the "same" as the behavior of the "same" stopwatch presented in court as evidence, or in the laboratory where it was tested. This can be illustrated by the legal proposition that computers are 'reliable' because there are more computers. 6.126 Considering computers “reliable” because they are used more often is a poor substitute for a thorough understanding of the nature of computers and their software. This resulted in the aircraft's course being altered to the east, over the Andes Mountains. Oversteered in flight 154 km west of Learmonth.1 In this case, a problem with the software controlling the aircraft was the cause of the accident. 5 A "Wells Notice" is a letter sent by a securities regulator to a potential respondent informing him of the substance of charges that the regulator intends to bring against the respondent and giving the respondent an opportunity to make a written statement to the final decision maker. SAM, like some others in the computer industry, seems to be of the mindset that when there is a 'bug' the customer has to pay to fix it. In September 2015, the United States Environmental Protection Agency issued a notice of violation of the Clean Air Act to Volkswagen AG, Audi AG, and Volkswagen Group of America, Inc.1 The notice alleged that four-cylinder Volkswagen and Audi diesel vehicles covering the years 2009-15 contain software that circumvented emission standards for some air pollutants. Over a one-year operating period, the emission of this additional pollutant by Volkswagen was estimated to have resulted in 5 to 50 premature deaths.3 The Department of Justice subsequently filed a complaint for alleged violations of the Clean Air Act.4. Emergency services: London Ambulance computer aided dispatch systemEvidence in digital form
Documents and disclosure or discovery
Visual reading of a document
Authentication
Best evidence
Analogue evidence
Digital evidence
Civil proceedings
Criminal proceedings
Admissibility
Weight
Execution and electronic signatures
Video and audio evidence
Testimonial use in legal proceedings
Identification and recognition evidence
Computer generated animations and simulations
Computer-generated evidence in England and Wales: civil proceedings
Computer-generated evidence in England and Wales: criminal proceedings
Hearsay
The foundations of the rule of hearsay exclusion
Public policy justifications for a rule of exclusion
Defining hearsay
Civil proceedings and the requirement to give notice
Elements of hearsay
Business and other documents
Judicial discretion to exclude
Concluding observations
Software code as the witness Stephen Mason
The classification of digital data
Content written by one or more people
Records generated by the software that have not had any input from a human
Records comprising a mix of human input and calculations generated by software
The purpose of a presumption
Presumptions and mechanical instruments
Judicial formulations of the presumption that mechanical instruments are in order when used
Judicial notice
A ‘notorious’ class
Common knowledge
Properly constructed
Evidential foundations of the presumption
How judges assess the evidence
Mechanical instruments and computer devices
The nature of software errors
Why software appears to fail
Classification of software errors
Human errors in the software code
Failure of specification
Unintended software interactions
The development, maintenance and operation of software
Developmental issues and software errors
Increasing the risk of errors through modification of software
Security vulnerabilities
Software testing
Software standards
Summary
Challenging ‘reliability’
Aviation industry
Financial products
Transport industry
