Published: 25-03-2019, Remon Verkerk

A digital forensic scan provides a wealth of new information that can contribute to the finding of truth. What have been an individual’s activities in a certain period of time, with whom has communication taken place, where was someone, is there any preparation acts? In order to find the necessary information, the appropriate data sources should be identified and secured for analysis (see also article Missed Opportunities – identification of data sources). We’re not there yet…

Complaint to non prosecution

With the necessary pride, PSG can count several big names in the legal profession among its clientele. Lawyers, in turn, represent clients in civil and criminal litigation. In the latter case, this often concerns assistance in a so-called ‘Article 12 Sv procedure’, i.e. a ‘Complaint to non prosecution’.

What is an Article 12 Sv procedure?
Do you disagree with the D.A.’s decision not to prosecute the defendant? Or do you think the D.A. should not impose a sentence, but that the case should go to trial? Then you can file a complaint with the court. This is referred to as an Article 12 Sv procedure. The court will decide whether the defendant should go to court.

Source: https://www.slachtofferhulp.nl/strafproces/aangifte-tot-straf/officier-van-justitie-beslist-over-de-zaak/klacht-niet-vervolging-artikel-12-procedure/

Inspection of court documents

For PSG, this means that we are regularly asked questions by the lawyer who assists a victim of a crime. After gaining access to the court documents (Art. 51 Sv), lawyers often come across extensive research files. These files often also contain reports of findings on digital commuter research, requiring specialist knowledge to assess whether further scrutiny makes sense. Not infrequently, the conclusion of digital research on the content of a data carrier is as follows:

“Data searched; found nothing relevant.”

What does this actually say and how much value can we derive from such a conclusion? In my immodest opinion, we do not have much use for such an inference, provided that it is accompanied by the necessary explication on what dates have been examined and the way in which the analysis took place.

“By me, verbalisant, the secured data carriers were searched using forensic software based on the following search terms: bicycle, lock, hacksaw, cracking, theft, healing, etc.

This did not provide any relevant information.”

A fictitious example of a common conclusion

 

Not all data simply lends itself to search based on search terms, and a pre-treatment is needed to make them searchable. Think, for example, of scanned text, text within images, archived or furthest files (encryption), deleted or hidden files, foreign languages, et cetera.

It is therefore highly recommended that digital detectives and other forensic investigators describe as much as possible where they have searched and HOW they have searched. This prevents unnecessary double-carried research and offers new perspectives on research opportunities.

Finally, I would like to say that what seems irrelevant at some point may prove to be of great importance at a later date!