Evidence in Criminal Cases and Legal Disputes

What you'll be able to do

By the end of this lesson you will be able to explain how digital evidence is used in criminal cases and in civil disputes, and what the courts expect of it.

• Describe the forensic actions in a criminal investigation, including digital footprint analysis.
• Describe the actions in a civil dispute, including audit trails and e-discovery.
• Explain why evidence that helps the other side must be reported, and what courts require of expert evidence.

Scenario: Digital Evidence in a Criminal Investigation

The situation. Police find that a suspect's smartphone, computer or external storage may contain evidence linking them to a crime: photos, documents or communications.

The actions the book lists:

• Device imaging. A bit-by-bit forensic image is created so that no evidence is altered.
• Data examination. The device is analyzed for deleted files, encrypted data, browsing history and other artifacts that could show the suspect's activities.
• Digital footprint analysis. The suspect's online activity (browsing, email, social media and geolocation data) is examined to build a timeline of events.
• Password cracking. If the device is protected, experts may lawfully attempt to crack or bypass the password (Lesson 3.7).

The outcome. The book makes an important point that is easy to miss: the evidence found could strengthen the case against the suspect or exonerate them. A forensic examination is a search for what happened, not a search for proof of guilt.

Scenario: Evidence in a Legal Dispute

The situation. Two companies are in a legal dispute. One claims the other violated its intellectual property, for example by copying proprietary software or data.

The actions the book lists:

• Digital evidence collection from computers, servers and cloud storage, to find any unauthorized use of the proprietary material.
• Data analysis of file metadata, email correspondence and data transfers, to determine whether the material was copied or misused.
• Audit trails. System and application logs are reviewed for suspicious access to, or transfer of, the material.

The outcome. The investigation may support or refute the claim, and the findings help the court resolve the dispute.

Criminal and Civil: What Changes

The techniques are the same; the legal framework differs.

• Authority. In criminal cases, police act under warrants and statutory powers. In civil cases, evidence is usually exchanged between the parties under court rules, through e-discovery: identifying, preserving, collecting and producing electronic information.
• Preservation duties. Once litigation is expected, parties must keep relevant data. A legal hold (Lesson 1.4) tells custodians exactly what to preserve. In US federal courts, if electronically stored information that should have been kept is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced, the court may order measures to cure the harm to the other side and, if the party intended to deprive the other side of the information, impose severe sanctions.
• Disclosure. In criminal cases, the prosecution generally has duties to disclose material that could help the defense. Whoever hires the examiner, findings that cut against the hiring side must still be reported. That is the ethical rule from Lesson 4.1.

What Courts Expect of Expert Evidence

Courts want to know that forensic evidence is reliable. In US federal courts, Rule 702 of the Federal Rules of Evidence governs expert testimony. Since an amendment in December 2023, it states plainly that expert testimony may be admitted only if the party offering it shows the court that it is more likely than not that the testimony is based on sufficient facts or data, is the product of reliable principles and methods, and reflects a reliable application of those methods to the case. Other countries have their own rules, but the expectations are similar everywhere: a sound method, applied properly, explained honestly.

Real-World Example

Imagine (a fictional scenario) a dispute between two software companies. Company A claims that Company B's new product contains code copied from A's product by a developer who moved between them.

Under court rules, both companies preserve and produce relevant material. The examiner for Company A analyzes Company B's code repository history, which was produced in e-discovery. It shows that 14 source files were added in a single commit two days after the developer joined. Several contain unusual comments and variable names identical to A's code. Metadata in B's issue tracker shows the files were described as "migrated from old project". The audit trail of A's systems shows the developer downloaded the same files the week before leaving.

The examiner's report sets out these facts and their sources. It also notes something that helps Company B: two of the 14 files also appear in a public open-source library that both companies use, so their similarity proves nothing. Reporting that is not weakness. It is what makes the rest of the report credible.

From the Book to 2026

What the book teaches. In criminal cases: image devices, examine data, analyze the digital footprint and lawfully overcome passwords. Findings may convict or exonerate. In legal disputes: collect evidence, analyze metadata and communications, review audit trails, and support or refute the claim.

Why it made sense. These remain the core actions in both settings.

What has changed. Courts' expectations of expert evidence have become more explicit, as the 2023 amendment to US Federal Rule of Evidence 702 shows. Courts also accept hash-based authentication of copied data (Federal Rule of Evidence 902(14), Lesson 1.4). Much of the digital footprint now lives in cloud services, so criminal investigators often rely on legal process to providers, including across borders under arrangements such as the US CLOUD Act. Civil e-discovery routinely includes collaboration platforms, chat apps and code repositories, not just email.

What to do now. Document your method so that a court can see it is reliable. Report what supports and what undermines each side's case, and plan for evidence that sits with providers, often in other countries.

What Would You Do?

You are hired by the prosecution. Your analysis of the defendant's phone finds a location record placing the phone 40 km away from the crime scene at the time of the crime. The detective says: "That doesn't help us, leave it out." What do you do? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• Criminal cases: device imaging, data examination, digital footprint timelines and lawful password recovery. Findings may convict or exonerate.
• Civil disputes: evidence collection, metadata and communications analysis, and audit trails, usually through e-discovery under court rules.
• Preserve data once litigation is expected, and report findings that help either side.
• Courts expect reliable methods, reliably applied. In US federal courts, FRE 702 (amended 2023) makes this explicit.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 9 (scenarios 5 and 7)
• Cornell Law School LII — Federal Rules of Evidence, Rule 702 (with 2023 amendment notes)
• Cornell Law School LII — Federal Rules of Evidence, Rule 902 (including 902(14))
• Cornell Law School LII — Federal Rules of Civil Procedure, Rule 37 (failure to preserve electronically stored information)
• US Department of Justice — CLOUD Act resources
• Professor Messer — Digital Forensics, CompTIA Security+ SY0-701 4.8 (legal hold and e-discovery)