RESEARCH ARTICLES

 

Fusing business, science and law: presenting digital evidence in court

 

 

MM Grobler^I; SH von Solms^II

^ICouncil for Scientific and Industrial Research, Pretoria
^IIAcademy for Information Technology, University of Johannesburg

 

 

---

ABSTRACT

With the explosion of digital crime, science becomes more frequently applied in court. Criminals are exploiting the same technological advances that have helped Law Enforcement to progress; these exploits are often at the expense of businesses. The purpose of the article is to make business managers aware of the intricate relationship between business, science and the law.
Businesses are regularly the target of digital crime and should be proactive in their forensic readiness. Scientists often present the evidence themselves, and need to be comfortable explaining technical principles to non-technical individuals. The legal system need to fairly arbitrate crime and presented evidence, integrating both business and scientific principles to ensure a fair ruling. It is necessary to bridge the gap between these disciplines to ensure the successful presentation of digital evidence in court.
Digital Forensics is a contemporary management issue that should be embraced as vantage point within the business world. It is not only IT specialists that can be called to testify on digital incidents in a court of law, but any manager or senior employee and these individuals should be adequately prepared for this. Business, science and law should therefore find a compromise to ensure that the presentation of digital evidence in court benefits all the disciplines involved.

Key phrases: Expert witness, court of law, business fraud, digital evidence, forensic investigator, court procedures, digital incidents

---

 

 

1 INTRODUCTION

"... The rapid, widespread adoption of new technology often outpaces society's development of a shared ethic governing its use and the ability of legal systems to deal with it. The handling of digital evidence is a perfect example" (NCJ 211314 2007:11).

Computers and other digital devices have been used for a number of decades. Its relation with crime has proliferated enormously since the early 1990s, and is still growing at a rapid pace. Accordingly, digital evidence is more readily used within the legal boundaries. It can be problematic, however, when different disciplines need to come together to solve a crime.

The modern world evolves around information: information originates as computer files, email replaces conventional postal letters and many business transactions take place in the electronic domain. Electronic data is routine in the daily operation of businesses (Rothstein, Hedges & Wiggins 2007:1). However, information is abstract and intangible, making it difficult for lawyers to present as evidence in a court of law, and even more so for investigators or witnesses to explain. To fuse the gap between the modern world and the electronic domain, all business employees should be comfortable with the relationship between the business world, computers and related legal aspects. Any manager or senior employee can be called as expert witness to testify on digital incidents, and should be adequately prepared for these occurrences. The focus of this paper is on preparing business people to testify on digital information.

The Theory Underlying Presenting Evidence in Court

The Association of Chief Police Offices (ACPO) in the United Kingdom put together a best practice document on presenting digital evidence in court. This document endorses four ACPO principles to ensure the admissibility of digital evidence in court:

• Principle 1: The data stored on a digital exhibit, such as content and metadata, should remain intact and unmodified.

• Principle 2: Any person accessing the exhibit must be competent to do so and explain the relevance and the implications of their actions.

• Principle 3: A record of all processes applied to an exhibit should be kept. These procedures must be repeatable to an independent third party, without altering the original data.

• Principle 4: The person in charge of the investigation is responsible to ensure that the law, the forensic procedures and these principles are adhered to (Kennedy 2006:Internet).

These principles are sound theory. However, forensic investigators (scientific domain) need to present digital evidence (scientific domain) from an incident that occurred in an individual or organisation scenario (business domain) to a judge (legal domain) - they need more practical guidance than four principles. For example, investigators need practical guidelines on how to ensure that the content of a suspect hard drive (Principle 1) remains unmodified. These guidelines may be procedures regarding the use of a write blocker and documenting a chain of custody.

A fusion between the scientific, business and legal domains is necessary if digital evidence is to be used to its best advantage in civil and criminal proceedings. The intention of this paper is to bring the scientific, business and legal domains closer together to assist in the use and presentation of digital evidence in the trial process.

The Practice Behind Presenting Evidence in Court

When a business suffers some form of digital incident, it is customary for a forensic investigator to conduct an investigation and testify as expert witness in court. Although not all incidents end in court, the same practice should be followed for intra-organisational disciplinary hearings. Should evidence be found at a later stage that might elevate the incident to criminal status, the forensic procedures followed will be admissible in court. If the incident remains within the boundary of the organisation, the procedure followed is according to regulatory standards, and an employee cannot appeal based on an inadequate or unfair process followed.

It is the investigator's function to collect evidence, examine it and present it to court, whilst adhering to the four ACPO principles. He/she needs to understand the scientific discipline and have a good grasp of the nature of evidence, also understanding the conditions under which it may be ruled inadmissible (Jones 2004:273).

Most investigators realise that their evidence can be crucial to the outcome of a trial. As a result, presentation of evidence in court is an important element in the judicial decision making process (true for both digital and non-digital evidence). The manner in which investigators present themselves and the evidence in a court scenario plays a major role in establishing the adequacy and integrity of the evidence (Stockdale & Gresham 1995:1).

Investigators presenting evidence should address the following elements when preparing for a court appearance:

• personal presentation (looks and composure);

• cross-examination;

• written notes;

• proper procedural preparation;

• proper court preparation; and

• training.

Since businesses are often the targets of various forms of digital crime and the legal system needs to look into all aspects of the case, businesses are often subjected to intense scrutiny during investigations. It is possible that the ordinary business man/ woman may be called to testify as witnesses to a digital incident that took place in the business environment. Therefore, role players in both the scientific and business domain should be knowledgeable on the elements of court appearance and adequately prepared for the accidental role of expert witness.

These elements (discussed in Sections 4 to 10) apply to both forensic investigators and business people that are required to testify. In the remainder of this paper, these individuals are referred to as expert witnesses. An expert witness is any person who has knowledge or experience beyond that which an average person would possess on a specific topic that he/she is to testify on in court.

An expert witnesses' role is to help the court reach a decision based on the evidence placed before it. It is the not the expert witnesses' job to secure a conviction, but rather to explain what he/she has seen, heard, recorded or done. This testimony must be done in an honest and impartial fashion, without embellishment and exaggeration (Stockdale & Gresham 1995:32).

The next section will briefly look at digital evidence and its role within the three mentioned disciplines.

 

2 DIGITAL EVIDENCE IN DIFFERENT DISCIPLINES

"... Digital evidence encompasses any and all digital data that can establish that a crime has been committed or can provide a link between a crime and its victim or a crime and its perpetrator' (Casey 2000:1). Digital evidence includes emails, web pages, word processing files, spreadsheets, databases, flash memory and optical disks, among other things (Rothstein et al 2007:2).

A deep chasm currently exists between the disciplines. On the one end of the spectrum lies the scientific domain, in which technology are developed (in this analogy the scientific domain refers specifically to technology and digital devices). On the same end of the spectrum lies the business domain, using the technology developed in the scientific domain. On the opposite side of the spectrum lies the legal domain, focusing on laws and the application of legal principles.

The chasm runs deep; some judges and lawyers may harbour doubts about the reliability and significance of digital evidence in a court case (NCJ 211314 2007:11). "While judges may resist the use of technological advances within the court itself, we cannot avoid the impact of these scientific and information revolutions on the substance of what we do. The rush of new scientific developments has been so swift that the court system is struggling to deal with the expert testimony they produce ." (Shelton 2006:63).

The challenge for the expert witness is that the technical complexity of many digital incidents surpasses the technical knowledge and experience of the court (Kennedy 2006:Internet). The onus therefore lies with the expert witness to sufficiently explain complex technical and business concepts in simple terms with carefully selected analogies and visual aids. It can be fatal if forensic investigators assume that lawyers and their business counterparts understand the unique problems associated with recovering and analysing digital evidence. Equally, it can be fatal if lawyers assume that expert witnesses understand the intricacies of the legal domain.

All parties involved in a court case concerning digital evidence should take special care to share their domain's knowledge in an appropriate manner with their counterparts (NCJ 211314 2007:11). Especially with Digital Forensics, where the court may not be too familiar with the topic, it is necessary to educate the audience. The expert witness need to explain the underlying scientific theory to the audience. This may include the forensically sound manner to collect evidence, the chain of custody, establishing origin and authenticity (Stephenson 2004:17).

All three domains need to work together to ensure the admissibility of the digital evidence in court. Admission means that the forensic investigator has complied with the ACPO principles, the lawyer can proceed with the court case and the business counterpart can address the digital incident.

 

3 THE ROLE OF THE EXPERT WITNESS

Many scientific and technical questions cannot be answered with either a yes or a no. It is often a question of degree/extent and the interpretation thereof. In addition, an increasing number of scientific and technical questions arising in litigation are of a level of complexity that may be beyond the understanding of the average judge and lawyer without careful explanation in plain language. This can often result in conflicting opinions or misunderstanding by a judge (Hodgson 2004:2).

An expert witness, regardless of whether they are called by the plaintiff or the defendant, has a duty to assist the court in matters relevant to their area of expertise. The witness should not be perceived as an advocate for a specific party and must truthfully, objectively and fully express his/her expert opinion, without regard to any views or influence which the person retaining or employing the expert may have or seek to exercise. "... An expert witness, like any ordinary witness, may give evidence of pure facts, but his principal function as an expert is not to relate facts but give evidence of his opinion. The expert witness is the only kind of witness who is allowed to state his opinion. The opinion must be the expert's own opinion" (Hodgson 2004: 4, 6).

The criteria presented in Table 1 should ensure an impartial expert witness.

If an individual meets all these criteria, he/she can be regarded as an expert witness. These witnesses are expected to testify in court. The next sections focus on the elements of testifying in court, as introduced in Section 1.

 

4 PERSONAL PRESENTATION - LOOKS

Justice is supposed to be blind, not to be influenced by the plaintiff, defendant or witness' position in life, political orientation, race or fashion sense (Garfinkle 2003: Internet). However, human nature does play a role. The so-called first impressions last apply in court when witnesses for example appear shabby-looking or the defendant attends in casual wear, with a couple of days' worth of stubble.

Irrespective of whether witnesses give evidence in uniform or plain clothes, a smart appearance makes a much better impression on the judge. In general, people trust individuals more who take care of their appearance and presents more stylish. This does not refer to high fashion suits, but rather a neat appearance (Stockdale & Gresham 1995:35).

The basic guidelines for dress revolve around professionalism and modesty. On the one hand, the witness needs to look his/her best to try to convince the audience inadvertently that the testimony is credible and legitimate. On the other hand, the witness should be modest in appearance, not presenting an air of arrogance. Generally, business attire is appropriate, even when normal work attire is more relaxed (Kruse II & Heiser 2002:19). Men should preferably always wear a tie, and women may wear modest jewellery. Neither should be too extravagant or distracting. The personal image presented to the judge and opposing counsel will appear more distinguished when dressed favourably (Garfinkle 2003:internet).

 

5 PERSONAL PRESENTATION - COMPOSURE

Since it is natural to be nervous when giving evidence, witnesses should be well prepared and comfortable with the court procedures and rules of evidence. A failure to speak clearly and confidently, or to give concise answers, generally reduces the witness and evidence's credibility. In addition, a clear presentation and confident manner, combined with truthfulness and honesty, presents a witness in a much better light. Good presentational skills can largely aid a prosecution.

Investigators should remain fair, objective and calm under all circumstances. A courteous and pleasant manner, especially whilst under cross-examination, can aid a case significantly. Table 2 shows characteristics that an expert witness should possess when presenting evidence.

Body language plays a major role in presenting a confident composure in court. Whether it involves touching your face constantly, finger drumming, nail biting or looking down when speaking, the audience may perceive this as negative body gauge. This may unintentionally lead to a negative perception of the witness and the evidence (Garfinkle 2003:Internet).

 

6 CROSS-EXAMINATION

When the evidence presented is damning, some defence counsels may resort to attacking the credibility of the expert witness. By challenging his/her level of expertise and competence, they attempt to show that the second ACPO principle (competence) has not been adhered to (Kennedy 2006:Internet). This cross-examination can be very stressful and investigators need to be adequately prepared for this. In a study conducted by Stockdale and Gresham (1995:5), a large proportion of police officers admitted that they had difficulty coping with cross-examination on their evidence. They feel offended and distressed by defence's insinuations and even outright accusations of lying.

Witnesses tend to become guarded and defensive under cross-examination, afraid of contradicting themselves or colleagues. They are also reluctant to admit that they might be mistaken. Errors or omissions due to poor preparation and a lack of knowledge of the case can make witnesses additionally vulnerable under cross-examination and can diminish both their own credibility and that of the evidence they present.

Witnesses under cross-examination often allow their emotions to become involved and tend to show impatience or intolerance. Although it is a common reaction for individuals to become agitated when lawyers attack their integrity or challenge their evidence, it can seriously damage the prosecutor's case. Witnesses also tend to get involved in unnecessary arguments with the prosecuting counsel or loose their composure (Stockdale & Gresham 1995:1, 18-19).

The witness should listen carefully to the questions asked and think before answering. Should the witness not understand a vague, complex or poorly phrased question, he/she should say so and ask politely for clarification. The witness should wait a moment before answering any question. This slight pause gives the witness' attorney a chance to object to every question (Kruse II & Heiser 2002:19).

 

7 WRITTEN NOTES

The use of notebooks giving evidence is very controversial. However, most courts accept that expert witnesses may forget critical details and need to refresh their memories before a court case commences. This is especially true when complicated digital evidence is relevant to the investigation. Therefore, witnesses should make clear, intelligible and accurate notes of anything they see, hear or do around the time of the digital incident. These notes should enable the witness to recall specific actions and reasoning long after the incident itself (Solon & Harper 2004:280).

Written notes are of extreme importance in routine digital events or where cases have occurred a year or more prior to the court hearing. In these events, witnesses need to re-acquaint themselves with precise details of locations, times and verbatim accounts of conversations. Witnesses should not simply read their notes aloud during evidence presentation, but rather just refer to it as a memory aide.

When witnesses need to read extended passages from written notes, he/she should take care to animate the passage and not read in a boring, monotonous tone. This makes the material boring and difficult to understand, especially if the nature of the content is already complex, as in the case of digital evidence. Direct reading from notes should be limited to answering a precise point, such as verbatim quotes, times and vehicle registration numbers.

By simply reading from the notes, the witness gives the impression that he/she does not remember the case. In addition, the extended use of a notebook can convey the idea that the witness plays for time to think. This can render the evidence less convincing. Many witnesses resort to reading from their notes out of nervousness, appearing unprepared and less credible (Stockdale & Gresham 1995:22).

In general, the occasional reference to a notebook improves witnesses' performance on the stand. It assists to provide greater clarity and generally makes witnesses feel more confident and relaxed. On the other hand, over-dependence or the inappropriate use of written notes can be seen as detracting from a witness' credibility and the relevance of the evidence presented.

 

8 PROPER PROCEDURAL PREPARATION

Procedure is everything. Although the actual examination of the digital incident is crucial to the court case, opposing counsel often attacks the procedures followed by witnesses (Kennedy 2006:Internet). Especially in a forensic investigation, the expert witnesses' performance largely depends on the standard of prior processes: the efficiency of the investigation, the care taken in preparing the case papers and the adequacy of the witness' preparation.

As a rule, comprehensive collection and accurate recording of all evidence and investigative steps, combined with a well-documented chain of custody, lay the foundation of a good performance in the witness box (Stockdale & Gresham 1995:23).

In any investigation, the witness should be able to account for all the acquired data and devices during the entire extent of the forensic acquisition process. This chain of custody should commence the moment the witness enters the crime scene and continue until the court case completes. According to Ghelani (2006:Internet), chain of custody defines as the "... gathering and preservation of the identity and the integrity of the evidential proof that is required to prosecute the suspect in court". Scalet (2005:Internet) provides another definition: "... the process of validating how any kind of evidence has been gathered, tracked and protected on its way to a court of law". In essence, it is the maintenance of the integrity of the evidence from seizure until the time the witness produces it in court.

The core objective of maintaining chain of custody is to protect the integrity of the evidence. The protection of this integrity is only successful if an independent third party can examine the recorded process and achieve the same results (ACPO 2007:69). It serves to make it difficult for a defence attorney to argue that the witness tampered with the evidence whilst in his/her custody (Kruse II & Heiser 2002:6).

The chain of custody procedure is very simple. The evidence-tracking log documents anyone who possesses the evidence, the time at which they took and returned possession, and why they were in possession of the evidence. It documents the answers to the following questions:

• Who collected the evidence?

• How and where did the evidence collection take place?

• What are the date, time and place of the investigation?

• Who took possession of the evidence?

• What is the acquired evidence's media-specific description?

• What measures ensure the protection of the evidence in storage?

• Who took the evidence out of storage and why?

• What is the final fate of the evidence: destruction, secure deletion or returned to owner? (Ghelani 2006:Internet, Kruse II & Heiser 2002:8).

The ability to prosecute any case rests on the validity of the evidence usable in court. A court considers evidence valid if witnesses can prove that the evidence is in the same condition as during seizure. To do this, people who handled the evidence should testify as to the condition the evidence was in before and after it entered their possession. The more timeous chain of custody can replace this long and tedious process.

Scalet (2005:Internet) identified a number of rules when working with the chain of custody. These rules are listed below and should be adhered to by both forensic investigators and witnesses from the victim business as well.

• Expect that all evidence will end up in court. A poor chain of custody may cause the dismissal of digital evidence from a court. Since it is impossible to know the extent of the investigation beforehand, it is better to treat all evidence as court material. Even a simple internal investigation of an employee may escalate to a court case if you uncover details that prove it necessary.

• Guard the "best evidence" closely. Witnesses refer to the original image of a hard drive as best evidence. The witness should attach the chain of custody log to this best evidence and ensure sufficient and secure storage. Storage should preferably be either offsite or in a fireproof safe. As far as possible, investigators should never work with the best evidence. It is better to create a second copy and keep the best evidence as back up.

• Chain of custody logs should always be up-to-date. Every time a witness handles the evidence, he/she needs to update the chain of custody log. This is very important to prove the authenticity of the evidence in court.

• Do not submit hardware to court unless specifically required to. Courts accept validated copies of best evidence. Therefore, it is unnecessary to submit the original hardware or best evidence as evidence. In most cases, an affidavit supports the submission of a copy of the best evidence. In addition, the original evidence remains safe in storage throughout the investigation.

In general, expert witnesses should be familiar with court procedures and relevant recent legislation. Supplemented with better note taking and interviews during investigation, combined with more preparation and consultation with the prosecution counsel, should enable witnesses to perform better (Stockdale & Gresham 1995:23).

 

9 PROPER COURT PREPARATION

The first step in proper court preparation is to visit the courthouse at least once before actually participating as a witness. Courts can be highly intimidating, and lawyers and prosecutors can have an overwhelming presence. A prospective witness should familiarise him-/herself with the surroundings and court procedures to understand how a hearing is conducted, the roles of those present and the ways in which people behave. In general, court observation will make the court a more familiar and less intimidating place for a first time expert witness (Stockdale & Gresham 1995:33).

It is vital to ensure that the case is competently investigated and prepared and that witnesses have familiarised themselves with the material they are to present. If viable, witnesses should even prepare possible discussions for cross-examination. Of vital importance is one London-based police officer's 'rule of Ps' (slightly adapted): proper preparation prevents poor performance. Should an investigator be well organised and prepared, presenting evidence in court should not be too hard (Stockdale & Gresham 1995:8).

Once the investigator visited the courtroom, he/she need to prepare the evidence for the courtroom. Evidence need to be admitted to court before the trial commences. The admission and presentation of scientific evidence are guided by established judicial rules and legal precedent, ensuring that the evidence have integrity and authentication. In preparing the evidence, the investigator need to demonstrate that evidence has been acquired and handled in a way that was both lawful and accurate (Wang, Cannady & Rosenbluth 2005:124). Adequate preparation is a pre-requisite for good performance in the witness stand. Tell-tales of insufficient court preparation includes:

• poor investigative standards and inadequate file preparation, including inaccurate or incomplete note-taking at the time of an arrest or during an investigation;

• failure to re-read the notes/files before going into the witness stand;

• failure to ensure that exhibits are available and properly managed;

• insufficient consultation with the prosecution lawyers prior to the hearing; and

• failure to anticipate the questions that are likely to be asked in cross-examination (Stockdale & Gresham 1995:26).

A very important aspect that expert witnesses need to consider when preparing for court is the discussion of evidence outside the courtroom. Although it might occasionally be necessary to discuss the more intricate or ambiguous details with colleagues also involved in the case, there is a very fine line between discussing and colluding. Expert witnesses need to take due care not to compromise the integrity of the evidence with too open and casual discussion.

An equally important aspect is the rules of evidence. Cross-examiners often catch investigators off guard when they point out a witness' failure to understand the rules and attempt to introduce opinions or hearsay evidence. Although this is generally considered an innocent mistake, this may occasionally render the introduced evidence as inadmissible, portraying the witness as incompetent (Stockdale & Gresham 1995:27, 33).

 

10 TRAINING

In order to prepare witnesses fully in properly presenting themselves as expert witnesses, it is recommended that these individuals need to undergo some form of basic training. This can prepare witnesses for the overbearing atmosphere in a courtroom and familiarise them with the general order of events within the court. Training is very important to facilitate proper court preparation. Witness training can take numerous forms:

• mock court procedures and role-play using real cases;

• attending assertiveness and presentation course;

• more comprehensive recording of events and note-taking;

• enhanced instruction in court procedures and in the rules of evidence, including the exposition of the rules in respect of hearsay evidence;

• better investigative procedures;

• court observation (Stockdale & Gresham 1995:22-24, 30); and

• presentation of digital evidence in a simple easy-to-understand manner.

Expert witnesses are mainly selected based on their qualifications and experience. However, it remains crucial that these witnesses understand the general facts about the legal system, how to navigate in that system, particular communication skills such as report writing and testifying in deposition and court, and how to develop and manage their consulting practice (HGExperts.com 2008:Internet). Most of these aspects can be addressed through training.

 

11 CONCLUSION

With computer-based evidence playing an increasingly important role in the courtroom, the need for trained and qualified expert witnesses testifying have also increased. These witnesses come from both the scientific realm (forensic investigators) and the business realm (employees from the victim business).

This article presented guidelines for expert witnesses, both from the business and science domain, on how to prepare for testimony and how to react when testifying. These guidelines can prove to be vital in the modern business manager's handling of contemporary management issues.

 

BIBLIOGRAPHY

ACPO. 2007. Good practice guide for computer-based electronic evidence. London: 7Safe:1-72.         [ Links ]

CASEY E. 2000. Digital evidence and computer crime: Forensic Science, Computers and the Internet. London: Academic Press.         [ Links ]

GARFINKLE M.D. 2003. The hip-pocket guide to testifying in court. Available from: http://www.njlawnet.com/njlawreview/testifyingincourt.html (Accessed 8 January 2009).         [ Links ]

GHELANI, S. 2006. Chain of custody -a suspect's chargesheet. Available from: http://www.niiconsulting.com/checkmate/2006/02/chain-of-custody-a-suspects-chargesheet/ (Accessed 25 February 2008).         [ Links ]

HGEXPERTS.com. 2008. Expert witnesses training - directory of experts testimony and legal consultants in training. Available from: http://www.hgexperts.com/listing/Expert-Witness-Training.asp (Accessed 9 January 2009).         [ Links ]

HODGSON J. 2004. The role of the expert witness - a court perspective. Paper delivered to planning education foundation seminar "Evidence, Experts and Experience". Available from: www.courts.sa.gov.au/courts/environment/Papers/Expert_Witness_CH.doc (Accessed 8 January 2009).         [ Links ]

JONES R. 2004. Your day in court - the role of the expert witness. Digital Investigation, 1(4):273-278.         [ Links ]

KENNEDY I. 2006. Presenting digital evidence to court. Available from: http://www.bcs.org/server.php?show=ConWebDoc.7372 (Accessed 21 August 2009).         [ Links ]

KRUSE II W.G. & HEISER J.G. 2002. Computer forensics: incident response essentials. Boston: Addison-Wesley.         [ Links ]

NCJ 211314. 2007. Digital evidence in the courtroom: a guide for law enforcement and prosecutors. US Department of Justice. Available from: www.ojp.usdoj.gov/nij/pubs-sum/211314.htm (Accessed 21 August 2009).         [ Links ]

ROTHSTEIN B.J., HEDGES R.J. & WIGGINS E.C. 2007. Managing discovery of electronic information: a pocket guide forjudges. Federal Judicial Center. Available from: http://www.fjc.gov/public/pdf.nsf/lookup/eldscpkt.pdf/$file/eldscpkt.pdf (Accessed 21 August 2009).         [ Links ]

SCALET S.D. 2005. How to keep a digital chain of custody. Available from: http://www.csoonline.com/read/120105/ht_custody.html (Accessed 25 February 2008).         [ Links ]

SHELTON D.E. 2006. Technology, Popular culture, and the court system - strange bedfellows? (In National Center for State Courts. Future trends in State Courts:63-66.         [ Links ]

SOLON M. & HARPER P. 2004. Preparing evidence for court. Digital Investigation, 1(4):279-283.         [ Links ]

STEPHENSON P. 2004. Ensuring the reliability and admissibility of digital evidence. Available from: http://people.emich.edu/pstephen/my_presentations/Ensuring%20the%20Reliability%20and%20Admissibility%20of%20Digital%20Evidence%20-%201%20hr.ppt (Accessed 21 August2009).         [ Links ]

STOCKDALE J.E. & GRESHAM P.J. 1995. The presentation of police evidence in court. Police Research Series. Paper 15. Home Office Police Research Group. London: Crown.         [ Links ]

WANG Y., CANNADY J. & ROSENBLUTH J. 2005. Foundations of computer forensics: a technology for the fight against computer crime. Computer Law & Security Report, 21:119-127.         [ Links ]