Difficult and unlikely based on what?
I should have added that the suggestion of digital evidence tampering by law enforcement is an even more difficult and unlikely scenario.
Based upon my 30+ years working with computer technology, the last 15 of which were in forensics and data recovery often working alongside law enforcement. It is not difficult to falsify an e-mail but it is not easy to do so in such a was as to be undiscovered especially if you don't have any control over the MTA. And the risk to one's career if they were ever caught is substantial.
It is one thing to plant an unregistered revolver on the body of a suspect (someone does it in "Law and Order" once a season), but it is something completely different to try to falsify digital evidence and do so in a way that avoids detection.
To the point if you do all these items in the investigation and then have to testify or need to write reports which will be used for the relatives defense, there is a strong chance those could get tossed or the Judge could rule that the jury should take little to no stock in the report.
On what basis do you arrive at this conclusion? Facts are facts. It doesn't matter if they matter if they are discovered by a relative or someone else. The judge is the gatekeeper of the facts and has the option to instruct the jury as to how much weight the facts and expert opinions should be given. The relationship to the subject may play into these but it wouldn't, automatically, be a cause to exclude the testimony.
A personal rule of mine is never, ever get involved professionally with friends and family.
It would ruin the relationship, and my impartiality is, and should be called into question.
Seriously Sean? Pretty sure if you have been around 15 years you have run into someone who was not found to be a credible witness and or didn't meet the standards. Why risk any factors when you get one shot at something, especially like something precious as a family.
How about impartiality? A family member saying I did the investigation, WOULD play a factor into the case. I wont argue facts are facts what about opinions? Are opinions opinions, or are they subject to a standard. Pretty sure we do what we do because we expect to be found as experts and as such can offer our opinions.
As far as the part about doing in an undetectable manner, that was covered in another thread, and I will continue to disagree with that, when all items are controlled by one party it is not that hard to change things around. But once again it is dependent upon the skills of the investigator looking at the data and the knowledge they possess.
Difficult and unlikely based on what?
I should have added that the suggestion of digital evidence tampering by law enforcement is an even more difficult and unlikely scenario.
Based upon my 30+ years working with computer technology, the last 15 of which were in forensics and data recovery often working alongside law enforcement. It is not difficult to falsify an e-mail but it is not easy to do so in such a was as to be undiscovered especially if you don't have any control over the MTA. And the risk to one's career if they were ever caught is substantial.
It is one thing to plant an unregistered revolver on the body of a suspect (someone does it in "Law and Order" once a season), but it is something completely different to try to falsify digital evidence and do so in a way that avoids detection.
To the point if you do all these items in the investigation and then have to testify or need to write reports which will be used for the relatives defense, there is a strong chance those could get tossed or the Judge could rule that the jury should take little to no stock in the report.
On what basis do you arrive at this conclusion? Facts are facts. It doesn't matter if they matter if they are discovered by a relative or someone else. The judge is the gatekeeper of the facts and has the option to instruct the jury as to how much weight the facts and expert opinions should be given. The relationship to the subject may play into these but it wouldn't, automatically, be a cause to exclude the testimony.
A personal rule of mine is never, ever get involved professionally with friends and family.
It would ruin the relationship, and my impartiality is, and should be called into question.
True. And as they say in medicine, those who have themselves as a physician have a fool for a patient. Nonetheless, the law is somewhat different. While I would not seek out a relative for a defense witness it remains the fact that a relative can be a witness, expert or fact.
And, besides, it is mere fantasy to suggest that expert witnesses are not impartial. In the US we have an adversarial system which means that each side advocates for its client and the jury is the determiner of fact.
All of us, I would think, aspire to be objective. But the attorneys and not us determines what is admitted as evidence and expert opinion.
Seriously Sean? Pretty sure if you have been around 15 years you have run into someone who was not found to be a credible witness and or didn't meet the standards. Why risk any factors when you get one shot at something, especially like something precious as a family.
True. I have. But, as I said, the judge determines what the jury gets to hear and the jury is the determiner of fact. Besides, the OP was simply asking for opinions about how to conduct an investigation; not whether he/she should.
How about impartiality? A family member saying I did the investigation, WOULD play a factor into the case. I wont argue facts are facts what about opinions? Are opinions opinions, or are they subject to a standard. Pretty sure we do what we do because we expect to be found as experts and as such can offer our opinions.
I don't disagree with this. See the above. But I have been involved in cases where the expert had a relationship with the party and, in my experience, this has not always served to disqualify the testimony. In fact, I think that the expert risks more than the client because it is their impartiality that may be questioned.
As far as the part about doing in an undetectable manner, that was covered in another thread, and I will continue to disagree with that, when all items are controlled by one party it is not that hard to change things around. But once again it is dependent upon the skills of the investigator looking at the data and the knowledge they possess.
I'll repeat my challenge. Send me an image of a system in which there is at least one e-mail/file alleged to have been tampered with and challenge me to detect it.
Sure, if you are talking about a simple text file, that is easy. But when you are talking about files which have associated metadata, tampering (by law enforcement), is not as simple as anyone might allege.
To the point if you do all these items in the investigation and then have to testify or need to write reports which will be used for the relatives defense, there is a strong chance those could get tossed or the Judge could rule that the jury should take little to no stock in the report.
Again. That may either be your opinion or experience. It is not mine. Judges are not likely to toss testimony/evidence based solely on the source. They may instruct the jury as to how to regard it, but that is different.
This is for help in a defense case. I already have evidence to show that an email used as probable cause in seizing the client's machine was doctored/falsified and looking to see if there is any issue with the other findings.
Any help is greatly appreciated
I can think of about 20 questions I would ask before going any further. Such as, "If you already have evidence, what is it?" Do you really have evidence, or just suspicion?
The reason I ask that is because if you have evidence, then you must have something tangible to back that up. i.e. The original un-tampered with email and the tampered email.
Then it is a matter of trying to prove who, what, where and when the tampering took place.
If all you have is an email that someone said was tampered with, and you cannot show that actual tampering occurred with tangible evidence in the form of an original prior to the tampering, or copies of the email in the process of it being changed, all you have is a claim that tampering occurred.
I think you are going to need more than that to challenge the validity of the email used as probable cause.