Can data from computer forensic investigation be denied as evidence?

Question

3 computers were sealed and taken from a person's apartment. Investigators invited him to unseal the PCs; the seals were intact and confirmed by owner and they started the cloning process. However, the hashes were just photographed by an expert without putting them into a document and giving it to the person who's being investigated, saying that they will invite him the next day to finish the paperwork. He wasn't invited, not even after 4 days, meaning that all devices remained unsealed all these days.

Considering the above facts:

1. Can evidence found by computer forensic expert be used in a court?

2. Could a lawyer challenge this evidence in court given the procedure of investigation?

3. Is there any applicable case law?

Note: All hard-drives were cloned using a write-blocking device. Click this link to see what it looks like. Software that was/is used in investigations is FTK if I am not mistaken.

Answer 1

Short Answer

Chain of custody is a common challenge to the admissibility and weight of evidence.

Qualification

This sounds like a real case. Not a hypothetical. The outcome can go either way. It sounds like it's heading for litigation. The result will depend on the facts and legal arguments.

If this is meant to be a hypothetical there are too few facts described to be able to analyze it.

I suggest you hire an attorney and forget about getting the question answered here.

Generally speaking, it's impossible to prove a negative. So on that basis, proving they did not tamper with the data will be a challenge at best. Lawyers can always challenge evidence. And chain of custody is a common challenge to the admissibility and weight of evidence.

Answer 2

Edit - this all assumes civil court, not criminal since the question does not mention cops.

---

The problem you describe sounds procedural. It does not sound like any spoliation has occurred. Assuming you can get a hash match the fact the computers are "unsealed" for a period of time is not going to matter.

But assuming you don't get a hash match, the evidence can still be admitted. The attorney will call the forensic expert who will lay the foundation for the evidence. Stating what it is and where it was found etc. On cross examination the other side can ask about the hash problem but if the expert can establish that the evidence as shown is accurate then the chain of custody might not carry much weight. In other words the evidence will be admitted, it's up to the parties to argue about how to weight it.

It sounds like the concern is that the owner was not present when the hashes were calculated. I don't see what this gets you. It's rare for a party to hang around while forensic engineers do their work. As for whether he wrote down, copied and pasted, or photographed the hashes this doesn't get you much either. The hashes exist to confirm that the working copy is the same as the original forensic image. As I said at the beginning, matching hashes is all that is needed for verification and a photo can be used to support foundation.

If something was promised but not given, the judge might order the thing, but even then what does it get the party here? All that will happen is you'll confirm that nothing was spoliated or that if it was then you can argue about weight.

As for cases, those are going to be hard to find. It's rare that chain of custody impacts the outcome of a case. To the extent that electronic discovery makes it into an order or opinion it's usually the result of a sanctions motion. So start there. But even then the best facts can be found in the motions and pleadings which requires some time on PACER.

If you are going to challenge, make sure the lawyer knows what he or she is doing. You don't want the George Zimmerman Twitter guy.