IT Forensics · Solicitors & Criminal Defence Lawyers
How can a criminal defence lawyer technically prepare a statement under Section 257 of the Code of Criminal Procedure (StPO) regarding the findings of a digital forensics investigation?
A statement following the collection of evidence can help to interpret a technically ambiguous finding at an early stage.
Why this question is important for a criminal defence
During the course of the taking of evidence, individual technical statements may be given considerable weight. To ensure a proper defence, it must remain clear whether a statement follows directly from primary data, is based on an automated interpretation, or requires additional assumptions.
Technical investigative approach
We summarise the findings in terms of the data source, technical significance, limitations of the findings and, where applicable, a specific, verifiable counter-finding.
Where the limits of what can be said lie
Pursuant to Section 257(3) of the Code of Criminal Procedure, the statement must not pre-empt the closing address. The drafting of the statement in accordance with procedural requirements remains the responsibility of the defence counsel.
Why LanCologne?
At this stage of the trial, it is particularly important not to consider individual technical findings in isolation. Digital evidence can only be properly contextualised if its origin, data status, the logic behind its creation and its limitations are known.
LanCologne therefore consistently works from the primary finding to the conclusion. Automated reports, screenshots or software views are used for illustrative purposes but are not equated with the actual source of evidence. In the case of crucial findings, we examine the underlying files, databases, logs, metadata or other artefacts, insofar as the data infrastructure permits.
Findings that are incriminating and those that are exculpatory are treated according to the same professional standard. A technically feasible alternative is not deemed to constitute counter-evidence as long as there is no concrete evidence. Conversely, no further identification of a specific individual is inferred from a software display that appears plausible if the necessary connecting facts are not present.
The report should be comprehensible to defence lawyers and the court, whilst at the same time containing sufficient technical detail to enable another qualified IT forensic expert to understand and verify the key findings.
How we work
Incriminating, exculpatory and inconclusive findings
Our investigation is open-ended. If an incriminating finding is confirmed, this is documented in the same way as a credible counter-finding. If a technical question cannot be resolved due to a lack of data, several equally plausible causes or methodological limitations, this uncertainty is specifically noted.
Understandable to the defence and the court – comprehensible to other forensic experts
The key message is explained in clear, accessible language. The technical section documents data sources, identifiers, time references, integrity information, relevant raw data and validation steps. This enables another qualified IT forensic expert to carry out a technical review of the key findings.
LanCologne as an independent source of technical support for the defence
If, during the main hearing, digital evidence, new technical statements or contradictory IT forensic findings need to be assessed, LanCologne provides support through an objective, transparent and unbiased examination. The sole determining factor is what the available data actually proves.
Legal framework
Section 244 of the Code of Criminal Procedure (StPO) remains central to the ongoing taking of evidence. Under paragraph 2, the court must, of its own motion, extend the taking of evidence to cover all facts and evidence relevant to the decision. The requirements for a motion to adduce evidence and the statutory grounds for rejection are set out in particular in Section 244(3) et seq. of the Code of Criminal Procedure. LanCologne can identify technical factual issues and suitable sources of data, but does not itself submit motions to adduce evidence under criminal procedure.
Under Section 246(1) of the Code of Criminal Procedure, a request to take evidence may not be refused solely on the grounds that the evidence or the fact to be proved was raised out of time. The other provisions of Section 246, in particular those concerning possible applications for a stay of proceedings in the event of late submission, are procedural matters for the parties to the proceedings and the court.
Section 249 of the Code of Criminal Procedure governs documentary evidence. Under Section 249(1), electronic documents are deemed to be documents provided they are legible. Paragraph 2 sets out the conditions for the self-reading procedure. The technical task may involve verifying the version, origin and integrity of an electronic document; the court decides on the form of evidence to be taken.
Under section 257(2) of the Code of Criminal Procedure, the defence counsel must also be given the opportunity, upon request, to comment on each individual piece of evidence after it has been taken. Under paragraph 3, this statement must not pre-empt the closing statement. LanCologne may prepare technical details for this purpose, but does not make any procedural statements on behalf of the defence counsel.
If, during the main hearing, the legal basis changes or, in the cases covered by section 265, the facts of the case change, section 265 of the Code of Criminal Procedure (StPO) contains provisions regarding notification and, under certain conditions, suspension. Whether this provision applies in a specific case must be assessed on legal grounds. We shall confine ourselves to determining whether and how the factual basis has changed.
Once the taking of evidence has concluded, closing submissions are made in accordance with section 258 of the Code of Criminal Procedure. The actual assessment of the evidence is a matter for the court: pursuant to section 261 of the Code of Criminal Procedure, the court decides on the outcome of the taking of evidence in accordance with its free conviction, drawn from the entirety of the proceedings. A digital forensics report may explain technical facts and limitations, but it does not replace either the closing submissions or the court’s assessment of the evidence.
Frequently Asked Questions
LanCologne – IT Forensics for Lawyers & Criminal Defence Solicitors
Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.
Related to this topic
- How can it be verified whether an electronic document read out during the main hearing is technically identical to the original?
- How can the defence technically prepare and check electronic documents for the self-reading procedure?
- How can an electronic export of chat messages be technically verified before it is used in the main hearing?
- How can the defence verify whether a search query shown during the trial can be reproduced?