Why every case must preserve the original copy of the data from a phone or computer, and not merely a report of its analysis

Contents

The problem in a simple example
How a device examination proceeds
What a report will not show, and why it matters
An example from a computer: a file is more than its content
What this means for you
How it looks in practice
What the standards and the law say
The checksum: a seal that works only with the bag
What should go into the case file or deposit
Model wording
Checklists
Frequently asked questions

When the case file holds only a report
It cannot be shown that the data in the report comes from the seized device and has not been altered.
No supplementary or review opinion can be produced on the same material.
The opposing party cannot check whether the selection of data was fair and complete.
The examination usually cannot be repeated, because the device has changed state or no longer exists.

The essentials
Examining a phone or computer has two stages. First a full, faithful copy of the data is made. Then specialist software reads it, the expert selects what is relevant and prepares a report.
The copy is the equivalent of a seized document. The report is the equivalent of a note made while reviewing it. A note does not replace the document, however diligent it may be.
If the original copy is not preserved, no one — not the court, not the opposing party, not the next expert — will ever be able to check whether the report is truthful and complete.
A device cannot be examined again in the same state. Phones update themselves, disks go back into use, data is overwritten. The copy made on the day of seizure is usually the only one.
The problem concerns every digital forensics tool and every kind of device. The remedy is simple and cheap: preserve the copy, its digital fingerprint and the documentation until the case is finally concluded.

The problem in a simple example

Digital evidence is easier to grasp when compared with traditional evidence. Imagine two situations.

A case with paper documents

In a commercial case the company's accounting books were seized. An officer reviewed them and drew up a list of twenty suspicious transactions. The list was added to the case file and the books were returned to the company, which destroyed them.

At the hearing, defence counsel argues that other transactions in the same books explain the disputed payments. No one can check this, because the books no longer exist.

A case with a phone or computer

A copy of the data was made from the suspect's phone. An expert reviewed it with analysis software and prepared a report containing selected messages. The report was added to the case file. The copy was not preserved and the phone was returned to its owner, who restored it to factory settings.

At the hearing, defence counsel argues that earlier messages change the meaning of those in the report. No one can check this, because the copy no longer exists.

In the first situation every lawyer sees the error immediately. In the second, the same error is made routinely, because a report from a phone examination looks professional, contains checksums, the software vendor's logo and thousands of entries. It gives the impression of complete evidence. It is, however, only a description of the evidence, prepared by one person with the help of one program.

The fundamental rule
A report answers the question "what was found". The original copy of the data makes it possible to check whether that is true and whether that is all. Digital evidence without the original copy is evidence that cannot be verified.

How a device examination proceeds

Whether the subject is a phone, a computer, a disk or a USB stick, and regardless of the software vendor, an examination proceeds in two stages.

The two stages of an examination: the device yields an original copy with a checksum, and the report is produced from that copy. There is no route back from the report to the device. — **Fig. 1.** The report is produced from the original copy, but the copy cannot be reconstructed from the report. If the copy disappears and the device changes state, the route back to the source is cut for good.

Key terms and what they mean for a case

Original copy of the data — forensic image, extraction

A faithful copy of the entire contents of a device, made with a specialist tool. For a computer it is called a forensic image of the disk: every fragment of the medium is copied, including the areas holding remnants of deleted files. For a phone one speaks of an extraction. What it means: this is the actual evidence. Everything else is a description of it.

Report — PDF, HTML, a viewable package

The product of the expert's work with the analysis software. It contains the data the software recognised and the expert considered relevant, together with its description: dates, senders, content. What it means: convenient to read, but always incomplete and dependent on the software and on the expert's decisions.

Checksum — hash, e.g. SHA-256

A string computed from the copy of the data, working like a digital fingerprint. Changing even a single character in the copy produces an entirely different value. What it means: it allows one to show that the copy has not been altered. It works, however, only as long as the copy exists and the value can be computed again.

Metadata — data about data

Information about a file or a message rather than its content: when it was created, when it was changed, where it came from, where it was stored, whether it was opened. What it means: this is usually what answers the questions "who, when and from where". It is most easily lost when individual files are copied.

Write blocker

A device or piece of software that allows a disk to be read but prevents anything from being written to it. What it means: it guarantees that the examination itself did not alter the evidence.

An example from practice: Cellebrite tools
Cellebrite is one of the most widely used systems for examining phones. The UFED tool makes the original copy of the phone's data. The Physical Analyzer program analyses it. From that program a report is exported, among others in the UFDR format, which can be viewed in the free Cellebrite Reader. The names UFED and UFDR are often confused, yet they are entirely different things: the first is the acquisition tool, the second a report. A UFDR package is not the original copy of the phone. The same principle applies to other systems, among them Magnet AXIOM and Graykey, MSAB XRY, Oxygen Forensic, and for computers EnCase, FTK, X-Ways or Autopsy.

What a report will not show, and why it matters

Between the original copy and the report the data passes through two filters. The first is the software, which recognises only the formats and applications it knows. The second is the expert, who selects the data that answers the questions put by the authority. What reaches the report is usually a small fraction of the device's contents.

Comparison of the scope of data at successive stages: the complete contents of the device, the data recognised by the software, the data selected by the expert, and what reaches the report. — **Fig. 2.** An indicative comparison of the scope of data at successive stages. The proportions differ in every case, but the report is always only a part of the whole.

Context

The report shows selected messages, photographs or documents. It does not show what came before and after them, nor other conversations with the same person.

Why this matters: a fragment of a conversation may mean something entirely different from the whole. Assessing evidence without context is assessing a fragment.

Data the software did not recognise

Analysis programs are updated regularly, because applications change the way they store data. The version used during the examination may not have read a new version of a messenger or an unusual file.

Why this matters: a newer version of the program, or a different tool, will read that data from the same copy. Without the copy it is lost for good, even though it might have been decisive for either side.

The actual date and time

Devices record time as a number. The software converts it into a readable date according to the time zone that has been set. A wrong setting, or a missed daylight-saving change, shifts every time in the report.

Why this matters: the time a message was sent or a file created may determine an alibi or the order of events. It can only be checked in the original data.

The provenance of the data

A report does not always make clear whether a message or file was active on the device or was recovered from remnants after deletion, nor how it got onto the device.

Why this matters: this determines whether the user knew the data existed and whether they deleted it deliberately. It is often decisive for liability.

What nobody looked for

The expert answers the questions set out in the court order or the instruction. Data nobody asked about is not selected for the report.

Why this matters: circumstances favourable to the other side may lie in the part of the data that never reached the report. Without the copy they can never be found.

An example from a computer: a file is more than its content

With computers a very common error is to place in the case file only the files copied from the disk, for example documents or photographs written to a USB stick or a disc. The content of the file stays the same. What is lost is the information that makes it possible to establish where the file came from, when it appeared on the computer and whether the user made use of it.

The same file in the original disk image and after being copied to a medium. The content remains identical, but the timestamps, the location on disk, the mark of origin and the traces of use are lost. — **Fig. 3.** The same file in the original disk image and after copying. The content is identical, but only the original copy answers questions about the file's provenance and about awareness of possessing it.

For example: in a case concerning the downloading of illegal material, or the removal of company data, the key question is whether the user downloaded or copied the file themselves and whether they opened it, or whether the file reached the disk without their knowledge. The answer is given by a set of traces: the write date in the file system, the mark of download from the internet, an entry in the list of recently opened documents, a thumbnail in the cache. None of these traces is present in the copied file. All of them are in the original disk image.

"The disk is in the deposit, so it can always be examined again"
This is a common and mistaken assumption. Modern SSDs, once connected to power, reorganise data by themselves and may permanently remove remnants of deleted files even when nothing is being written to them. Company disks and servers go back into use. An encrypted disk may be impossible to read if the key was protected only on a working computer. A new copy made years later may have a different checksum from the one in the opinion and cannot be tied to the original examination. The copy made on the day of seizure is most often the only reliable one.

What this means for you

The consequences of a missing original copy affect every participant in the proceedings, but in different ways. Below we describe the risks and practical steps for each group.

Prosecutor

commissioning the examination and responsible for the evidential material

Risk

The indictment rests on evidence whose reliability cannot be demonstrated once the defence challenges it.
A supplementary or new opinion turns out to be impossible, because there is nothing to carry it out on.
Doubts that cannot be resolved are decided in favour of the accused.

What to do

State in the order appointing the expert that they are to hand over the original copy, the checksums and the documentation (model wording in section 10).
Do not permit the return of the device until it has been confirmed that the copy is secured and verified.
Establish in writing who keeps the copy and for how long.

Court

assessing the reliability of the evidence

Risk

Assessing evidence solely on the basis of a description, with no way of checking its foundations.
A conflict between experts that cannot be resolved, because neither has access to the same material.
Protracted proceedings and the risk of findings being overturned on appeal.

What is worth checking

Whether the original copy exists, where it is kept, and whether its checksum matches the opinion.
Whether the opinion states the time zone of the dates and the criteria for selecting data for the report.
Whether the party challenging the evidence had the opportunity to examine the source material.

Defence counsel and attorneys

representing a party to the proceedings

Risk

No real possibility of verifying the evidence against the client, including checking context and dates.
Circumstances favourable to the client may lie in data that never reached the report.

What is worth checking

Whether the case file or the deposit contains the original copy, or only a report or copied files.
Whether the opinion states the examination method, the tools with their versions, the checksums, the time zone and the criteria for selecting data.
Whether the material can be examined by a specialist nominated by the party. The absence of an original copy is in itself a circumstance material to the assessment of the evidence.

Police

seizing devices and performing technical actions

Risk

The very action on which the whole case depends turns out to be impossible to repeat or to verify.
An allegation that the data was altered during seizure, with no means of rebutting it.

What to do

Make a full copy of the device rather than copying selected files. If a full copy is impossible, record the reason in the report.
Hand over the copy together with its checksum and a description of the tools used.
Do not browse the contents of the device before the examination, because every such action changes data.

A company or private individual commissioning an examination

for example in an employment, commercial or family matter, or before filing a notification of an offence

Risk

An examination you paid for loses its value in court once the other side challenges the report and there is no original copy.
The employee's computer or phone passes to another person or is reformatted, and there is no longer any source from which the evidence could be reconstructed.
Browsing the device yourself before handing it to the laboratory changes data and gives the other side an argument that the evidence was compromised.

What to do

Set the device aside before the examination and do not use it. Do not pass it to another employee.
Include in the contract with the laboratory an obligation to make a full copy, to hand a copy of it to the client, to state the checksums and to keep the copy until the dispute ends (model wording in section 10).
Store the medium you receive in a documented manner, so that you can show who had access to it.

The outcome

The evidence can neither be supplemented nor verified.

What the standards and the law say

International standards and guidelines on digital evidence are not statutes. They do, however, describe the current state of knowledge, and a court assesses evidence taking the indications of knowledge into account (Article 7 of the Polish Code of Criminal Procedure). All these documents, whatever the country or institution, come down to three requirements.

Integrity

It must be possible to show that the evidence has not changed since the moment of seizure.

The court's question: how do we know that the data in the report is the same data that was on the device?

Repeatability

Another expert, given the same material, should be able to repeat the examination and reach the same conclusions.

The court's question: can anyone else check this?

Documentation

It is known who did what with the material and when, with which tools and with what result.

The court's question: how did this report come about, and what happened to the evidence?

Every one of these requirements assumes that the original copy exists. Without it integrity cannot be shown, the examination cannot be repeated, and the documentation describes material that is not there.

These requirements follow, among others, from ISO/IEC 27037 (preservation of digital evidence), ISO/IEC 27042 (analysis and interpretation of digital evidence), the guidelines of the American NIST institute on computer and mobile device examinations, and the guidelines of the European Network of Forensic Science Institutes (ENFSI). The British ACPO guidelines put it most simply: all actions taken on digital evidence should be documented so that an independent person can check them and obtain the same result.

Provisions that apply here

Article 200 § 2 (5) of the Code of Criminal Procedure

An opinion must contain a record of the actions taken and the observations made, together with the conclusions drawn from them.

In practice: a record can only be verified against the material it concerns. Without the original copy it remains an assertion by the expert.

Article 201 of the Code of Criminal Procedure

Where an opinion is incomplete or unclear, or where opinions conflict, the same experts may be recalled or others appointed.

In practice: the provision assumes there is something on which a further opinion can be produced. Without the original copy that possibility is illusory.

Article 5 § 2 of the Code of Criminal Procedure

Doubts that cannot be removed are resolved in favour of the accused.

In practice: the absence of an original copy creates precisely such doubts. This works against the prosecution, not against the accused.

Article 6 of the European Convention on Human Rights

The right to a fair trial and to adequate facilities for the preparation of a defence, including the principle of equality of arms.

In practice: in Sigurður Einarsson and Others v. Iceland (judgment of 4 June 2019, application no. 39757/15) the European Court of Human Rights considered the defence's access to the full set of electronic data from which the prosecution had selected its evidence. In that particular case it found no violation, but it indicated that refusing such access may in principle infringe the rights of the defence. Access is possible only where the full set of data has been preserved.

Disclaimer
This discussion of the law is informational and presents the position of the laboratory as a body carrying out examinations. It does not constitute legal advice. Assessing the procedural consequences in a particular case is a matter for the authority conducting the proceedings and for the court.

The checksum: a seal that works only with the bag

A checksum works like the number on an evidence bag seal. If the seal number in the record matches the number on the bag, it is known that the bag was not opened. The tool computes the value at the moment the copy is made, and the expert enters it in the opinion. Anyone can then compute the value for the copy they were given and compare it with the opinion.

There is, however, a condition: a seal number without the bag proves nothing. A checksum in an opinion has value only as long as the copy it was computed from still exists.

Verifying a checksum: from making the copy, through the record of seizure and the opinion, to recomputing and comparing. The last step requires the preserved copy. — **Fig. 4.** Verifying a checksum. Without the preserved copy the final step is impossible, and the value in the opinion loses its evidential meaning.

A common misunderstanding
Reports from analysis programs often contain checksums of their own, which gives the impression that they are protected in the same way as the copy. Such a value proves only that nobody altered the report file after it was created. It does not prove that the report faithfully and completely reflects the contents of the device.

What should go into the case file or deposit

Below is the recommended set of material after examining a phone or computer, whatever software was used. The items marked as mandatory are, in our view, the minimum without which the evidential value of the examination is at risk.

Item	What it contains	What it is needed for	Status
Opinion or report	Answers to the questions, description of the method, the tools and their versions, checksums, time zone, criteria for selecting data	Explains what was examined, how and with what result	Mandatory
Original copy of the data	A full copy of the phone or a disk image in the form created by the tool, together with the description files and the acquisition log	It is the actual evidence and the only basis for verification	Mandatory
Device documentation	Photographs, condition on receipt, identification numbers (IMEI, serial number of the device and of the disk)	Ties the copy to a specific device	Mandatory
Viewable report	For example a UFDR package, a Portable Case, an HTML report, with a note on which program opens it	Lets the authority, the court and the parties work with the data conveniently	Recommended
PDF summary	Data relevant to the case in printable form	A legible presentation in the file and at the hearing	Recommended
Analysis project files	Settings and tags from the analysis software	Allows the course of the expert's work to be reconstructed	On request

How to store the original copy

Two sets. One sealed and untouched, the second for working. If the working set is damaged, the reference set remains intact.
Encryption. The copy contains the whole life of the device's owner: private correspondence, photographs, health data, data about other people. The medium should be encrypted and the password handed over separately.
Period. At least until the case is finally concluded. Given the possibility of cassation and of reopening proceedings, the decision to delete should be taken by the authority, not by the laboratory.
Controlled access. Access to the copy should follow from a decision of the authority and should be recorded. The copy contains far more than the case requires.
Size. A copy of a phone or disk is usually anything from tens of gigabytes to several terabytes. It is worth settling how it will be stored when the examination is commissioned.

The most common organisational error
The laboratory deletes the data once its retention period expires, and the commissioning party does not know that the copy never reached the case file. Each side assumes the material is with the other. Establish in writing who keeps the original copy and for how long.

Model wording

The simplest way to avoid the problem is to specify from the outset what material the expert or the laboratory is to deliver. The wording below can be adapted to a particular case.

For an order appointing an expert

The expert is required to:

make a full copy of the data from the device (medium) … (make, model, serial number or IMEI) by a method ensuring the widest available scope of data, in particular a forensic image of the medium made with a write blocker, or a full file system extraction of the mobile device, and to describe in the opinion the method applied, the tools used and their versions;
compute SHA-256 hash values for the copy made, immediately after its creation, and state them in the opinion;
state in the opinion the time zone in which dates and times are given, and the criteria for selecting the data included in the report;
deliver together with the opinion:
1. a medium containing the full copy of the data in its original form, together with the description files and the acquisition log,
2. a report in a format allowing the data to be browsed independently, together with information on the software required,
3. a summary of the data relevant to the case in the form of a PDF file;
encrypt the media and transmit the password by a separate route;
retain the working copy until a separate decision of the authority and not delete it without such a decision.

For a contract with a laboratory (private client)

The contractor undertakes to:

make a full copy of the data from the device provided (a forensic image or a full extraction) without introducing changes to its contents, and if a full copy is not possible, to state in writing the reason and the scope of the copy made;
compute and state in the report the SHA-256 checksums of the copy made;
prepare documentation covering the condition of the device on receipt, the course of the actions taken, the tools used and their versions;
deliver to the client, together with the report, an encrypted medium containing the full copy of the data in its original form, with the password transmitted by a separate route;
retain its own copy for a period of … or until released from that obligation in writing by the client, and not to delete it earlier without the client's written consent.

Checklists

Three short lists for the three moments at which it is easiest to go wrong.

Before returning the device

A full copy was made, not selected files.
The checksum of the copy is recorded in the report of seizure.
The copy has been checked and can be opened.
It is known who keeps the copy and for how long.

On receiving the opinion

The opinion states the method, the tools and their versions.
The opinion states the checksums of the copy.
The opinion states the time zone of the dates and times.
The opinion describes the criteria by which data was selected for the report.
A medium holding the original copy was delivered with the opinion, or its place of storage was indicated.

Before the hearing

The value computed from the delivered medium matches the opinion.
The password to the encrypted medium is available.
It is known which program opens the report.
There is a plan for making the material available to an expert or a party, should they apply for it.

Frequently asked questions

The report has a checksum and the vendor's logo. Is that not enough?

No. The checksum of a report confirms only that nobody altered the report file. It does not confirm that the report is complete and faithfully reflects the contents of the device. The software vendor's logo has no evidential significance.

The device is in the deposit. Does that not replace the copy?

Usually not. A phone that has gone flat and been switched on again may become impossible to read without the code. SSDs remove remnants of deleted data by themselves. A new copy made years later may have a different checksum from the one in the opinion and cannot be tied to the original examination. A device in the deposit is a valuable additional safeguard, but it does not replace the copy made on the day of the examination.

Should the opposing party have access to the whole copy?

The copy contains far more than the case requires, including data about third parties. The scope and manner of access should therefore be determined by the authority or the court. The precondition for any access, however, is that the copy exists at all. If it is deleted, deciding on the scope of access becomes pointless.

What should be done if the original copy no longer exists?

It is worth establishing whether the copy was preserved elsewhere (with the expert, at the laboratory, at a police unit), whether the device still exists and in what condition, and exactly what the report contained. A laboratory can assess whether re-examining the device is possible and what its scope would be.

The absence of a copy is in itself a circumstance that the parties and the court may take into account when assessing the reliability of the evidence.

Does this concern only Cellebrite tools?

No. Cellebrite is merely an example, because it is widely used with phones. The same principle applies to every digital forensics tool, every kind of device and every case: criminal, civil, employment or commercial.

Is storing a copy expensive?

The cost of a medium for a copy of a phone or disk is usually small compared with the cost of the examination, and incomparably smaller than the cost of losing the evidence in a case. What matters is to establish from the outset who keeps the copy and for how long.

Do you have doubts about the material in your case?

The FireNet laboratory helps to assess whether material from an examination of a phone or computer is complete and capable of being verified. We carry out acquisitions and analyses in accordance with the standards described here, and we prepare review opinions for authorities, law firms and private clients.