Criminal defence · prosecution evidence · independent review · integrity check · expert report
Criminal defence review of digital evidence. An independent check of the prosecution's digital evidence: does its integrity hold, and does it say what is claimed.
Digital evidence put forward by the prosecution deserves independent scrutiny, and that is work we do for the defence, on a solicitor's instruction. The first-stage review checks the things that are often simply assumed: whether the prosecution's forensic image was taken and hashed properly and whether its integrity holds; whether the artefacts relied on actually say what is claimed of them; and what alternative explanations the same data supports, because an artefact that is said to prove one thing frequently supports several readings. It is written as fact, and it gives the defence solicitor a clear basis on which to decide whether to instruct a full expert report for the court. Where the matter proceeds, that expert report, written to the Criminal Procedure Rules Part 19 in England and Wales or the equivalent Northern Ireland practice directions, with the expert's declarations and duty to the court, is quoted separately. We are instructed by the defence solicitor, we work to the court's timetable, and we are candid that our role is to test the evidence, not to guarantee an outcome.
Rather talk it through? An engineer answers the bench line
0800 6890668
Who instructs us, and the authority we need.
The instructing party is the defence solicitor, under formal instruction, with access to the prosecution's exhibits arranged through the usual channels. We ask for the instruction and the material. In England and Wales, legal aid pays a computer expert at the codified rate; in Northern Ireland the Legal Services Agency approves expert fees case by case and asks for comparative quotes, and we are content to be one of those quotes.
The first stage is a review: a factual check of the prosecution's imaging and hashes, the artefacts relied on, and the alternative explanations the data supports. It gives the solicitor a clear basis to decide whether a full expert report is warranted, without committing to the cost of one at the outset.
Where the matter proceeds, the expert report is written to the Criminal Procedure Rules Part 19 (England and Wales) or the equivalent Northern Ireland practice directions, with the expert's qualifications, the range of opinion, the declarations and the overriding duty to the court. It is quoted on the questions, the material and the timetable. We test the evidence; we do not promise a result.
What the standard report typically contains.
The questions it can answer, and what it cannot.
Describe your situation →| What you want to know | What the examination shows | What it cannot prove on its own |
|---|---|---|
| Whether the prosecution's evidence was handled properly | A check of the imaging, hashes and integrity | Guilt or innocence |
| Whether the artefacts support the claim | A review of the specific artefacts relied on | What was in the mind of any person |
| What else the data could mean | The alternative explanations the data supports | Which explanation is correct; that is for the court |
| Whether a full expert report is warranted | The first-stage review's findings | The outcome of the proceedings |
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send the exhibit
- Instruct early where you can, so the review fits the court's timetable and informs the decision on an expert report.
- Provide the exhibit access through the usual channels; we review the prosecution's own material.
- Tell us the questions the defence needs answered, so the review and any expert report address them.
A single artefact often admits of more than one reading, and an independent review sets out the alternative explanations the same data supports.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the questions you need answered
What sets us back
- Letting IT or anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Assuming artefacts prove who was at the keyboard
Questions answered before you instruct.
Can you review the prosecution's computer evidence against my client?
Yes, on the defence solicitor's instruction. The first-stage review checks whether the evidence was handled and hashed properly, whether the artefacts relied on say what is claimed, and what alternative explanations the data supports, giving you a basis to decide whether to instruct a full expert report.
Is this a standard report or an expert report?
The first-stage review is a factual report that informs the decision whether to go further. A criminal matter that proceeds will need an expert report written to the Criminal Procedure Rules Part 19, or the Northern Ireland equivalent, with declarations and the expert's duty to the court; that is quoted separately and runs into the thousands.
Will legal aid cover it?
In England and Wales legal aid pays a computer expert at the codified rate. In Northern Ireland the Legal Services Agency approves expert fees case by case and asks for comparative quotes; we are content to provide one. We will discuss fees and the legal-aid position at instruction.
Can you guarantee the evidence will be excluded or undermined?
No, and we would be wary of anyone who did. Our role is to test the evidence independently and set out, as fact, where its integrity or interpretation is open to question, and what else the data could mean. Whether that assists the defence is for the court.
What does it cost?
The first-stage review starts from £800 + VAT depending on the material; a full expert report for the court is quoted separately. We discuss the legal-aid position at instruction, and the first conversation is free.
The device holds the answer; preserve it first.
The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.