Kan metadata sikre validiteten til digitale dokumentbevis?

Abstract

More and more evidence in criminal proceedings are digital and an increasing amount of evidence is being gathered during crime investigation in Norway. The prosecuting authority’s obligation to present information about criminal cases in the best way possible leads to the presentation of large amounts of evidence. Then the judges must decide whether the evidence is going to be used. In Norwegian criminal jurisdiction both law and law practice are having troubles in keeping up with the speed of technological development, and today there are no guide lines as to the handling of digital forensic data. The technology is evolving so quickly that the lawyers and judges are having difficulties in keeping up to date with the latest developments and as a consequence often lack the technical competence they need.

Digital evidence and how this type of evidence is being handled is the focus of this master’s thesis. It gives an introduction to Norwegian criminal law and jurisdiction. The three phases of digital forensics are then laid out from a technological point of view. The chain of custody of digital documents used as evidence is explained. In addition, the thesis offers a look at relevant research in Norway, Europe and the USA.

To meet the legal requirements, a digital document used as evidence must be valid. The thesis raises the question as to whether metadata is able to ensure this validity. Metadata is information about a document’s properties. If metadata is to be used to determine the validity of a document, the information has to be correct, true and non-manipulated. The thesis aims to find out exactly what kind of metadata is being generated when a digital document is created, whether metadata can be manipulated, and if so, how and by whom.

The research shows that several metadata is generated. It is possible to manipulate and generate new metadata after the initial creation of a document. Several actors are able to manipulate – both software and personal actors. To claim that metadata is capable of ensuring the validity of a document – e.g. that timestamps are trustworthy information or that an expert witness can detect manipulation, is not correct. The thesis concludes that metadata can not ensure the validity of digital document evidence because it is possible to manipulate this information.