Examination of Firearms Review: 2007 to 2010 - Interpol

performing digital forensic examinations (45). The recommendations state
that validation testing is critical to the outcome of the entire examination
process. Validation is essential to demonstrate that examination tools,
techniques and procedures are suitable for their intended purpose. It
recommends that tools, techniques and procedures should be validated
prior to initial use in digital forensic processes. Failure to implement a
validation program can have detrimental effects (46).
Sommer argues that regulatory trends in forensic science point strongly to
the need for exhaustive testing of all findings and tools (47). Sommer
states that the message from forensic science to expert witnesses is clear:
evidence tendered. should be based on validated scientific knowledge; all
tools and procedures deployed should have been subject to independent
testing to demonstrate compliance with their stated claims. He poses the
question, what happens if the raw material with which you work changes at
a rate faster than these cycles of publishing and testing? In fields such as
digital forensics, the rate of technological change is faster than the normal
times required for peer-reviewed publication.
4 Digital Forensic Examinations
4.1 Evidence triage
Casey submits that missed evidence is a concern with survey/triage
forensic inspections and preliminary forensic examinations with the
possibility of overlooking exculpatory evidence48. Forensic examiners
must respond to all inquiries objectively, and they have a duty to the court
to report any potentially exculpatory or additional inculpatory evidence they
find. Forensic examiners are also obliged to reevaluate their findings or
alter their opinion in light of raised defences. However, there is no ethical
requirement that the forensic examiner fully investigate any or all potential
defenses (49).
Casey submit that if laboratories are to keep up with mounting case loads
while at the same time keeping current with technology developments, they
must innovate and adapt to a constantly evolving field (50).
4.2 Evidence reproducibility
The Internet is continuously developing with websites being added,
removed, and continuously updated. Eltgroth states that because of this
transitive nature of the World Wide Web, there is no certainty that a user
will be able to access content in an identical form in the future. For this
reason, the evidential value of data from a prohibited web site found on a
suspect’s computer may be limited if the prosecution is unable to prove the
existence of that website and its content at that point in time.
Eltgroth discusses the application of the Wayback Machine, a service
provided by the Internet Archive that accesses the largest online digital
collection of archived Web pages in the world. The Internet Archive
407