5.1 Digital Evidence Framework
Digital evidence presents unique challenges and opportunities for cross-examination. Unlike physical evidence, digital evidence can be easily copied, modified, or fabricated without visible trace - unless proper forensic protocols are followed.
The Legal Framework: Section 63 BSA
The Section 63 certificate is frequently defective - creating substantial cross-examination opportunities. Key requirements often overlooked:
- Responsible position: Certificate must be from someone with control over the computer
- Computer identification: Specific computer/device must be identified
- Regular operation: Computer was operating properly at relevant time
- Regular course: Information stored during regular activities
- Original source: Identifies the original electronic record
Without a valid Section 63 certificate, electronic evidence is inadmissible. Always challenge the certificate first - if it fails, the evidence falls regardless of what it shows.
5.2 Attacking the Section 63 Certificate
Common Certificate Defects
- Wrong certifier: Person signing is not in responsible position
- Missing particulars: Does not identify specific computer/device
- No timestamp: Does not specify when computer was operating properly
- Vague description: Does not adequately describe the electronic record
- Hearsay certificate: Certifier has no personal knowledge
Sample Cross-Examination: Certificate Attack
A: Yes.
Q: The certificate is signed by the company's legal manager?
A: Yes.
Q: Does the legal manager operate or maintain the email server?
A: No, that is the IT department.
Q: Does the legal manager have administrative access to the email system?
A: I don't believe so.
Q: So the person signing the certificate has no control over the computer system that stored this email?
A: He has authority to sign legal documents.
Q: But Section 63(4) requires the certificate from a person in responsible position "in relation to the operation of the relevant device or management of the relevant activities"?
A: ...
Q: Is the legal manager in a responsible position regarding the email server operation?
A: He represents the company.
Object to defective Section 63 certificates at the earliest opportunity. If objection is not taken when the document is tendered, it may be held to have been waived. Raise a specific, detailed objection on record.
5.3 Hash Values and Integrity
Understanding Hash Values
A hash value is a digital fingerprint - a unique string of characters generated by an algorithm that represents the content of a file. If even one bit of the file changes, the hash value changes completely. Forensic integrity depends on hash verification.
Common Hash Algorithms
- MD5: 128-bit hash, widely used but cryptographically weak
- SHA-1: 160-bit hash, deprecated for security applications
- SHA-256: 256-bit hash, current standard for forensic work
Cross-Examination: Hash Value Attack
A: Yes.
Q: Did you calculate a hash value of the phone's storage at the time of seizure?
A: Yes, we did forensic imaging.
Q: What hash value did you record at seizure?
A: I would need to check the report.
Q: Before you opened the phone for examination, did you verify the hash matched?
A: We followed standard procedures.
Q: I am asking specifically - did you compare hashes before and after?
A: The forensic software does this automatically.
Q: Show me in your report where both hash values are recorded and compared?
A: (reviewing report) The acquisition hash is recorded.
Q: But there is no hash from the original seizure point for comparison?
A: The seizure memo describes the phone.
Q: Without an original hash, how can you prove no data was added or deleted between seizure and imaging?
If the prosecution cannot demonstrate matching hash values from seizure through analysis, the integrity of the digital evidence is compromised. Any data could have been added, modified, or deleted.
5.4 Metadata Challenges
What is Metadata?
Metadata is "data about data" - information embedded in files about when they were created, modified, who created them, what device was used, and more. Metadata can prove or disprove claims about digital evidence.
Key Metadata Types
| Metadata Type | Information Contained | Cross-Exam Value |
|---|---|---|
| File System | Creation, modification, access times | Timestamp inconsistencies, backdating |
| Document | Author, company, revision history | Different author than claimed, edits |
| Email Headers | Server routing, timestamps, IP addresses | Spoofing, incorrect timestamps |
| Image EXIF | Camera model, GPS location, date/time | Location inconsistencies, device identification |
| Application | Software used, version, settings | Anachronistic software, editing evidence |
Sample Cross-Examination: Metadata Attack
A: Yes, that is the execution date.
Q: Have you examined the metadata of the Word document?
A: The document was printed and signed.
Q: I am asking about the digital file used to create it. Have you examined its metadata?
A: No.
Q: The metadata shows "Created: 28th March 2023" - 13 days after the supposed execution date?
A: The date on the document is 15th March.
Q: But the file was created on 28th March - how can you sign a document before it exists?
A: Perhaps it was recreated...
Q: The metadata also shows "Author: Not the signatory" - a different person created this file?
Always request the original digital files, not just printouts. Printouts lose all metadata. If only printouts are available, challenge the evidence as incomplete - the best evidence rule requires production of the original electronic record.
5.5 Chain of Custody for Digital Evidence
Digital Chain of Custody Requirements
Digital evidence requires stricter chain of custody documentation than physical evidence because modifications can be invisible. Every access to the device must be documented.
Chain of Custody Elements
- Seizure documentation: Who, when, where, condition of device
- Storage security: Locked storage, access logs, tamper-evident bags
- Write-blocking: Use of write-blockers during imaging
- Access log: Every person who accessed the device and why
- Hash verification: Hash comparison at each transfer point
Sample Cross-Examination: Chain of Custody
A: Yes.
Q: When was it sent to FSL for examination?
A: 25th January.
Q: 15 days after seizure?
A: There were formalities.
Q: Where was the phone stored during these 15 days?
A: In the Malkhana.
Q: Is the Malkhana a forensically secure environment for digital evidence?
A: It is the standard storage.
Q: Was the phone kept in a Faraday bag to prevent remote access?
A: I don't know what that is.
Q: A Faraday bag blocks wireless signals so the phone cannot be remotely accessed or wiped?
A: We switched off the phone.
Q: A phone can be turned on remotely if not shielded. Was any shielding used?
A: The phone was switched off.
Q: Who had access to the Malkhana during these 15 days?
A: The Malkhana officer.
Q: Is there an access log showing who entered and when?
A: There is a general register.
Digital evidence can be remotely modified, added, or deleted. Without proper isolation (Faraday bag), write-blocking, and documented chain of custody, the integrity of the evidence is questionable.
5.6 Challenging Digital Expert Qualifications
Digital Forensics Qualifications
Digital forensics is a rapidly evolving field. Experts must demonstrate current, relevant qualifications. Dated training or lack of certification undermines reliability.
Key Qualification Areas
- Formal education: Computer science, information security, forensics
- Certifications: EnCE, CCE, GCFE, CHFI - recognized forensic certifications
- Tool training: Certified on specific forensic tools used (EnCase, FTK, Cellebrite)
- Current knowledge: Recent training on current operating systems and devices
- Practical experience: Actual forensic examinations performed
Sample Cross-Examination: Qualification Challenge
A: Yes.
Q: What is your qualification in mobile forensics?
A: I am a scientific officer at FSL.
Q: What specific training have you received on iOS forensics?
A: We received general mobile forensics training.
Q: When was this training?
A: 2019.
Q: The iPhone 14 runs iOS 16 or later. Your training was on which iOS version?
A: I don't recall the specific version.
Q: iOS has changed significantly since 2019 - new security features, encryption methods?
A: We keep ourselves updated.
Q: Have you taken any certified course on iOS 16 forensics?
A: No formal certification.
Q: Are you certified on Cellebrite or GrayKey - tools used for iPhone forensics?
A: We have Cellebrite at our lab.
Q: But are you personally certified to use it?
A: We have been trained by the vendor.
Request the expert's CV, training certificates, and list of tools used before trial. This allows you to identify qualification gaps and prepare focused questions. Experts with outdated or limited qualifications are vulnerable to challenge.
5.7 Cross-Examining on Specific Digital Evidence Types
WhatsApp Messages
- End-to-end encryption: Server records only metadata, not content
- Backup extraction: Local backups may not be encrypted
- Timestamp manipulation: Device time can be changed
- Account switching: Same number can be used by different persons
Email Evidence
- Header analysis: Check routing through legitimate servers
- Spoofing possibility: Email "From" field can be forged
- Server records: Demand server-side logs, not just client printouts
- Timestamp verification: Compare email timestamp with server logs
CCTV Footage
- Original vs. copy: Demand original DVR evidence, not USB copies
- Timestamp accuracy: Was the DVR clock synchronized?
- Gap analysis: Are there unexplained gaps in footage?
- Resolution limitations: Can identification actually be made at that resolution?
"Digital evidence is both more powerful and more fragile than physical evidence. Its power lies in what it can prove; its fragility lies in how easily it can be manipulated by those with knowledge." Digital Forensics Handbook
Key Takeaways
- Section 63 BSA certificate is mandatory - attack defects to exclude evidence
- Hash values prove integrity - no matching hashes means compromised evidence
- Metadata reveals the true history of digital files - creation dates, authors, edits
- Chain of custody for digital evidence requires write-blocking, Faraday shielding, access logs
- Expert qualifications in digital forensics must be current and specific to the technology
- Always demand original digital files, not printouts
- Different evidence types (WhatsApp, email, CCTV) have specific vulnerabilities