Modern criminal and civil proceedings increasingly rely on digital evidence. Data stored on computers, phones, external drives or in the cloud can be a key source of information about legally relevant events. As a result, digital forensics—a set of techniques for preserving and analysing digital traces for the justice system—is developing rapidly. At the same time, and particularly significantly, Poland has not yet developed a generally accepted methodology in this field, which affects the quality and comparability of expert examinations.
This article discusses digital forensics standards, key norms and good practices relevant to the proper acquisition, preservation and analysis of digital evidence. It also presents differences between the American and Polish approaches and explains why preserving the integrity of evidentiary material is essential to the credibility of an expert opinion.
Contents
Basic concepts: digital forensics and forensic computing
The significance of digital evidence in procedural practice
Legal framework and standards for expert opinions
Good practice and standards in digital forensics
ISO/IEC standards and the Polish PN-EN ISO/IEC 27037 edition
Summary
References (APA 6)
1. Basic concepts: digital forensics and forensic computing
The literature uses several terms for the examination of digital evidence, including digital forensics, forensic computing, computer criminalistics, forensic informatics and computer forensics. These terminological differences reflect the field’s interdisciplinary nature and the absence of a uniform scientific classification.
Forensic computing may be understood as an area bridging law and computer science, encompassing the expert advisory role of computing, particularly computer-related forensic opinions. Digital forensics, in turn, primarily involves examination of computer devices and digital storage media, particularly for judicial proceedings, but also, for example, in data recovery cases.
In practice, this means that digital forensics is not merely ‘file analysis’, but covers the entire process of working with digital evidence: from identification and preservation, through copying and maintaining integrity, to analysis and formulation of conclusions.
2. The significance of digital evidence in procedural practice
Information technology now plays a dual role in legal violations: it can be both the ‘location’ of an offence, such as a storage medium or system, and a tool supporting criminal activity. Most data today is digital, and a so-called digital shadow is also created: information collected automatically in systems and services.
From the perspective of criminal proceedings, this means that digital evidence increasingly determines findings of fact, for example in cases involving computer fraud, unlawful access to systems, computer forgery and ‘content’ offences relating to the content of data.
It must also be emphasised that digital material is particularly vulnerable: it can easily be modified, overwritten or lost, and preservation errors can undermine its credibility. This is precisely why digital forensics standards and good practices are crucial to the quality of an expert opinion.
3. Legal framework and standards for expert opinions
A substantial proportion of digital evidence handling standards originated in the United States. This is due, among other things, to a stricter approach to the admissibility of evidence, including the ‘fruit of the poisonous tree’ doctrine and the exclusionary rule. In this model, procedural violations may result in evidence being excluded from the trial.
Article 168a of Poland’s Code of Criminal Procedure concerns the admissibility of evidence obtained in breach of procedural rules or through a prohibited act and includes an exception specified in that provision. Admissibility is separate from reliability, assessed under Article 7. Article 168a does not reduce the requirements for an expert opinion: Article 200 sets out its required content, while Article 201 allows the same experts to be recalled or others appointed if an opinion is incomplete, unclear or contradictory.
In the United States, the Daubert standard and Federal Rule of Evidence 702 also play an important role in assessing whether an expert opinion is scientific and meets reliability criteria. In Poland, case law on the admissibility of examination methods is relatively limited, although the importance of general acceptance of methods and consistency with current knowledge is emphasised.
4. Good practice and standards in digital forensics
Digital forensics develops extremely rapidly because technology changes quickly: SSDs have replaced traditional HDDs, mobile devices have become widespread, and data is increasingly stored in the cloud. In these conditions, creating rigid standards can be difficult: standardisation is a lengthy process, and standards must be sufficiently general to avoid becoming outdated as soon as they are published.
For this reason, good practices and guidelines developed by expert groups play a particular role. Leading American initiatives include:
SWGDE (Scientific Working Group on Digital Evidence), which develops guidelines on the technical aspects of digital forensics,
SWGIT (Scientific Working Group on Imaging Technology), which develops recommendations on image and video analysis,
standardisation activities within ANSI (American National Standards Institute),
NIST (National Institute of Standards and Technology) programs and resources, including CFTT (Computer Forensics Tool Testing Program) and reference file libraries such as NSRL.
For expert opinion practice, this means that working with digital evidence requires repeatable procedures, documentation of actions, checks on data integrity and the use of tools of known and verified quality.
5. ISO/IEC standards in digital forensics (including PN-EN ISO/IEC 27037)
Internationally, ISO/IEC standards relating to information security play an important role, including the ISO/IEC 27xxx family. Particularly relevant to digital forensics are:
ISO/IEC 27037—guidelines for identifying, collecting, acquiring and preserving digital evidence,
ISO/IEC 27041—guidance on ensuring the suitability of investigative methods,
ISO/IEC 27042—guidelines for analysing and interpreting digital evidence,
ISO/IEC 27043—principles and processes for investigations and incident investigations.
In Poland, it is particularly significant that ISO/IEC 27037 has a national edition: PN-EN ISO/IEC 27037:2016-12 (Polish version), containing guidelines for handling digital evidence.
In practice, applying these standards may increase the credibility of an expert examination, organise the examination process and make it easier to demonstrate that the evidence has not been compromised. This is particularly important when parties dispute the lawfulness or reliability of data preservation.
Summary
Digital forensics standards play a fundamental role in proceedings where digital evidence is crucial. Proper preservation and analysis of data require procedures that ensure material integrity, transparency of actions and the ability to verify results.
In practice, it is particularly important to use standards and good practices (ISO/IEC, SWGDE, NIST) and adapt standards to the realities of the Polish legal system. Disseminating methodological and tool-related knowledge among experts and specialists is a prerequisite for improving the quality of forensic computing and digital forensics opinions in Poland.
References (APA 6)
Szmit, M. (2018). O standardach informatyki śledczej. Studia Ekonomiczne. Zeszyty Naukowe Uniwersytetu Ekonomicznego w Katowicach, (355), 81–91.
Note: This article is for information purposes and does not constitute legal advice. In specific cases, analysis of the case files and consultation with a professional legal representative or expert are recommended.