1. Lesson # 7 A Practical Guide to Computer Forensics Investigations
Chapter 7
Admissibility of Digital Evidence

2. Lesson #: 7 Objectives
Review the structure of the legal system in the United States
Review the role of constitutional law in computer forensics
Understand principles of search and seizure of computers and other digital devices
Understand rules for the admissibility of evidence at trial
Review case law concerning the use of digital surveillance devices by law enforcement
Review cases of computer forensics gone wrong
Understand structure of the legal system in the European Union
Review data privacy and computer forensics in the European Union

3. History and Structure of the United States Legal System
Both federal and state laws impact criminal investigations and court trials.
Moreover, investigations and court proceedings at the state and county levels are influenced by the Constitution, which is a federal document that protects the rights of the individual.
A computer forensics investigator must abide by federal and state laws when conducting an investigation.
A case can be tried in a number of different ways. In a criminal investigation, a jury might find the defendant not guilty. A jury is a group of people put under oath to hear arguments at trial and render a verdict of guilty or not guilty.
A civil lawsuit then can ensue, with a victim seeking monetary compensation against an offender or third party for physical damage or emotional distress.
The plaintiff is the person who initiates the lawsuit and is responsible for the cost of litigation.
The defendant is the person who defends himself in a lawsuit.

4. History and Structure of the United States Legal System (cont.)
U.S. Court System

5. The Role of Constitutional Law in Computer Forensics
The right to a trial by jury is clearly outlined in the Sixth Amendment to the U.S. Constitution.
Voir dire is the questioning process used in the jury selection process. During voir dire, lawyers and, in some cases, the judge ask potential jurors questions to determine any prior knowledge of the facts of the case or any biases that could influence their impartiality in the case.
All defendants are presumed innocent until proven guilty beyond a reasonable doubt.
Jurors may be required to fill out a survey prior to oral questions.
Civil trials typically have 6 jurors and up to 4 alternates.
For criminal felony trials, there are 12 jurors and up to 6 alternatives.
In lesser criminal trials there may be 6 jurors and up to 4 alternates.
During the trial, jury members may not discuss the trial among themselves or with others and may not read about the case.

6. Principles of Search and Seizure of Computers and Other Digital Devices
Law enforcement must obtain a warrant issued by a judge or magistrate before a search or arrest can be carried out.
A search warrant is a court order issued by judge or magistrate authorizing law enforcement to search a person or place, as well as seize items or information within the parameters of the warrant.
An investigator must demonstrate probable cause.
Probable cause refers to the conditions under which law enforcement may obtain a warrant for a search or arrest when it is evident that a crime has been committed.
is probably the most important type of digital evidence, and it is continually addressed in many cases.

7. Case Law Concerning the Use of Digital Surveillance Devices by Law Enforcement
Stingray is the generic name given to a device that acts like a cell phone tower to locate criminal suspects but can also be used to locate people in disaster areas, such as earthquakes.
A pen register is an electronic device that captures telephone numbers. Pen register orders require law enforcement to show only that information retrieved is likely to assist in an ongoing investigation.
The use of GPS surveillance devices has clearly become a contentious issue, and there is a distinct lack of clarity in case law.
The acquisition of digital evidence during a traffic stop can appear somewhat confusing when perusing case law.

8. Case Law Concerning the Use of Digital Surveillance Devices by Law Enforcement (cont.)
The role of Congress is to write laws, whereas the federal courts interpret Congressional legislation and pass judgment over those who violate those laws.
Changes in technology have brought about changes in legislation.
Federal Wiretap Act (18 U.S.C. § 2511)
Foreign Intelligence Surveillance Act (FISA-1978
Computer Fraud and Abuse Act (18 U.S.C. § 2511
Corporate Espionage (18 U.S.C. § 1030(a)(1))
Communications Assistance for Law Enforcement Act (CALEA) (47 U.S.C. § 1002)
USA PATRIOT Act
PROTECT Act
Digital Millennium Copyright Act (DMCA) (17 U.S.C. § 1201)

9. Case Law Concerning the Use of Digital Surveillance Devices by Law Enforcement (cont.)
Rules for Evidence Admissibility
Frye Test for Evidence Admissibility
Daubert Test for Evidence Admissibility
Federal Rules of Evidence
Expert Witnesses
Federal Rules of Evidence (FRE) and Hearsay
Best Evidence Rule

10. Structure of the Legal System in the European Union
Structure of European Union Law
E. U. Legislature
Data Privacy
E. U. Directives on Child Pornography
Europol
OLAF (European Anti-fraud Office)

11. Chapter 7: Summary
Reviewed the structure of the legal system in the United States
Reviewed the role of constitutional law in computer forensics
Reviewed principles of search and seizure of computers and other digital devices
Reviewed rules for the admissibility of evidence at trial
Reviewed case law concerning the use of digital surveillance devices by law enforcement
Reviewed cases of computer forensics gone wrong
Reviewed structure of the legal system in the European Union
Reviewed data privacy and computer forensics in the European Union
Next Lesson: Chapter 7, “Network Forensics”