Constructing digital evidence: A study on how cognitive and human factors affect digital evidence

Abstract

We live in a globalized, digitized and interconnected society, where technology is woven into virtually every aspect of our social relationships and activities. Actions, movements, and communication leave digital traces, often without the actor's knowledge or effort. Such traces are also of great importance for solving crimes. It is therefore essential that digital traces are collected, examined, analysed, and presented in a way that safeguards their evidential value and minimizes erroneous and misleading results. Much research has been done on new methods, tools, processes, and frameworks for handling new technology or new ways of using technology. However, there are relatively few empirical studies of investigative practice among the police's experts in digital traces and evidence - the digital forensic (DF) practitioners. The thesis contributes to filling this knowledge gap with new insight into DF investigation practices, with the main emphasis on how the evidence is analysed and presented. A combination of research methods is used to answer the research question: How can a better understanding of the DF practitioners' role in constructing digital evidence within a criminal investigation enable mitigation of errors and safeguard a fair administration of justice? The thesis is made up of five articles exploring the research question from different perspectives. DF practitioners may be biased The thesis shows that DF practitioners can be influenced by information about the case without significance for the investigation, for example about what type of crime other investigators believe has happened or their assumptions about a suspect's role in the crime that is investigated. This is an important finding since such information easily flows to the DF investigator during the dissemination of assignments and collaboration during the investigation. The research shows that such information influenced how many traces the DF investigators uncovered, and that there is great variation in how they interpreted and concluded about the findings. Digital evidence is elastic Digital evidence is usually perceived as objective, value-neutral and reliable, and is therefore often assigned great value during the investigation and in the court of law. The thesis shows that DF practitioners affect the value of the digital traces through how they describe and present them in their reports. In some cases, this turns out as incorrect and misleading descriptions of the credibility of the traces or their relevance to the criminal case. This can, for example, be descriptions that point towards the suspect's guilt or innocence, or descriptions that present the evidence as more credible than what the investigation in fact provides as a basis for. The thesis’s findings are important for a better understanding of the uncertainties associated with digital traces and evidence, and for being able to develop effective quality assurance measures for DF investigations that can prevent errors of justice and safeguard the rule of law for those who are investigated by the police.