Questioning the “Biography” of a Digital File & Why It Matters

Digital technology has played an increasingly important role in the justice system. One of the many challenges when dealing with digital evidence is the sheer volume of data that can be contained in a single hard drive or flash drive. There can be thousands of files nested within each other, which can amount to literally hundreds of pages of discovery. It can also take hours to review the data, most of which can be completely irrelevant to the case.

So what is a criminal defense attorney supposed to do with the overwhelming amount of information? How can we use it to our advantage?

It is important to remember that the government has the burden of proof in criminal cases. It is their job to investigate, manage, and decipher all of that information in order to build a case. Just as you would have difficulty managing the entire scope of the data, so would the government.

Exploring the “Biography” of the File

Whether it is a financial crime or an online sex crime investigation, attorneys can capitalize on the unmanageable amount of data by delving deeper into the ”biography” of a data file. Each digital file has a history, a story, a narrative. With the help of experts, you can understand when it was created, where, its migration, and many more. Using this biographical approach during cross examinations can allow for easier presentation to the judge and jury.

Important questions to consider during cross-examinations regarding a particular file:

• What is the file name and its path?
• When was it first created?
• How did it end up on the user’s computer?
• Would a user know what files are being downloaded?
• Was the file viewed? For how long, when, and by whom? How can you tell?
• Was the file ever deleted?
• What did your investigation reveal regarding the activity of the file?

When law enforcement officers take the stand to testify their findings, you can take this opportunity to reveal what they really do not know (which is common) and what they cannot answer forensically. This is not surprising, given the difficulty of managing and even recalling information from such vast amounts of data.

Ask Questions – But Know the Answers

Don’t forget that you should never ask a question to which you do not know the answer. Always be prepared by consulting with experts and obtaining a better understanding of the data.