±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 3 Overall: 36459
New Yesterday: 5 Visitors: 161

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Online Documents as Evidence, Software License, Case Notes

Discussion of legislation relating to computer forensics.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 


Online Documents as Evidence, Software License, Case Notes

Post Posted: Aug 20, 13 05:32

Hey Guys & Gals,

Could any of you help me out on a few of things? (1) I have a client that is working with a local attorney that says online documents are not admissible in court. Not even documents printed from the DOJ, NIST, FBI or Microsoft websites. Is this correct? I have read the rules of evidence (from rule 101 to 1103) and I am still confused. I would assume that a document listed on a government website would be admissible in court, but I could very easily be wrong.

The second thing is that during my investigation, I trashed my case notes (hand written notes that I took during the examination). I am being asked to turn them over, but like I said I trashed them. They are claiming that I destroyed evidence and my examination should be thrown out. Is this correct?

Lastly, I was given an older copy of FTK by a friend several months back. I do not have a license for it and he said he was never asked to provide his during years of use. I didn't use the software in this case but I am worried if I use it in the future. If I do use it and cant provide the license can my examination get tossed?

Please save the keystrokes, I know I made some mistakes but I am just starting out in this field. I am learning and I will never make the same mistake twice.

Thanks Again in advance for any insight.  

Senior Member

Re: Online Documents as Evidence, Software License, Case Not

Post Posted: Aug 20, 13 07:34

to point 1, what documents? how could they not be admissible? its a copy of a document and that should be fine. can they be more specific as to WHY its not admissible?



its not like you can get the original from NIST, the FBI, etc.

the exam should stand by itself. did you prepare a report? i can only think someone would look at your notes vs your exam for discrepancies.

as to FTK, i dont recommend using any version of that software. =) in your friends case, where did he get the license and did he transfer it to you vs copying it and now you are in a position of having not paid for it?

if you dont have a valid license for FTK, dont pursue one. it will cost you far too much money for what you get in terms of the software and the minimum hardware requirements are downright insane.  


Re: Online Documents as Evidence, Software License, Case Not

Post Posted: Aug 20, 13 07:54

Thank you for the reply. I have printed documents about some of the procedures for first responders from the DOJ, along with some documents from Microsoft, US.gov on evidence collection and chain of custody. They have not made the final ruling but when we said we plan to introduce documents from these sites, the judge said we have to have some for of authentication or they wont be allowed.

They asked for the case notes and I told the attorney I had trashed them. He said the prosecution said those notes are part of evidence, thus I destroyed evidence. He has not ruled on that yet either.

The software was giving to me as a copy. I did not pay for it but I know he did a while back. He just does not have the license to give me. I don't really care much for it but it was free and I am just trying to get my feet wet. But if the court would throw out a case for using unlicensed software then I will toss it.

Again, thanks for the response. I planned to hear words like idiot, rookie, dumbazz, ext.


Senior Member

Re: Online Documents as Evidence, Software License, Case Not

Post Posted: Aug 20, 13 07:59

think about what would happen if you were on the stand and were asked by the defense:

1. what software you used
2. if you had a valid license for it

1 is easy to answer.

2 will end your career if you used pirated software. your friend did not do you any favors in giving you a copy.

i would take a step back and look for a local mentor that can help you get started in this field. as you are seeing already there are certain rules of the road you must follow or your career as an examiner will be short lived.

if i may ask, what is your background and education as it relates to being a forensic examiner?  

Senior Member

Re: Online Documents as Evidence, Software License, Case Not

Post Posted: Aug 20, 13 19:27

I don't see why online documents would be inadmissible unless the attorney is claiming they are hearsay. However, if you’re qualified as an expert in the case, you can testify to hearsay. Maybe the documents could be thrown out, but you could testify to the contents of the documents.

Don’t destroy your notes, even if you create a digital copy of them, keep the original. You can’t cure this problem, so you’ll just need to work with the attorney who hired you to work through this problem. I won’t say your notes are evidence, but you still don’t want to destroy anything related to the examination. Your examination report should be enough, but the other attorney obviously doesn’t want what you found to be admissible.

There is no such thing as a free version of FTK. I’m sure FTK is widely pirated, but using a pirated version of FTK may get your entire examination thrown out. It’s fortunate you didn’t use it in this case, but you should remove it and never use it without a valid license.

Let me give you a little insight into what’s happening to you. Ninety-nine percent of the time your notes and the source of your research will never be an issue in a case. But, when you have found something that is damning to the other side and they choose to fight rather than settle or plea, they will use every means available to get your testimony thrown out. The other attorney is throwing everything against the wall and seeing what will stick. That’s his job. Don’t take it personally, but do prepare for it.

Let’s say you get past this stage, and the judge allows the case to continue. When you get to the trial phase you will be challenged. This is commonly called a Daubert challenge. These challenges take place just before trial so that if you are thrown out as an expert your side will have no opportunity to replace you. If you want to see one that goes badly for the expert, take a look at this one:


I’ll agree with Eric again. Get yourself a mentor—preferably someone local who can help guide you through getting started in this field. As you’ve already seen, it’s easy to make little mistakes that become a big problem.

I strongly suggest you attend the NACVA’s Expert Witness Bootcamp. ( www.nacva.com/CTI/CTIE...otcamp.asp ) It does a good job of preparing you to testify and how to avoid the pitfalls that can open you up to a successful Daubert challenge.  

Senior Member

Re: Online Documents as Evidence, Software License, Case Not

Post Posted: Aug 20, 13 22:28

FTK imager is free
Michael Cotgrove


Re: Online Documents as Evidence, Software License, Case Not

Post Posted: Aug 21, 13 00:29

Guys thank you soooo much for the advice. I will do as you recommend. I will also toss FTK since I don't have a license for it. Again, thank for the help. I will also look into taking that class. It seems extremely useful.  

Page 1 of 2
Page 1, 2  Next