IT Forensics · Solicitors & Criminal Defence Lawyers
How can it be ascertained whether digital communications have been included in the indictment in their entirety or only selectively?
Individual messages can be misleading without the context of the conversation, replies, attachments or the timeline.
Why this question is important for a criminal defence
Once charges have been brought, the technical examination must focus on those digital facts that actually underpin the alleged facts of the case. Particularly in interim proceedings, it may be crucial to precisely delimit a technical finding, to provide comprehensible evidence for a relevant counter-hypothesis, or to specifically identify a question of evidence that remains unresolved.
Technical investigative approach
We examine the available conversation, including the thread structure, participants, status fields, attachments and reconstructed data states.
Where the limits of what can be said lie
A technical completeness check is no substitute for a linguistic or legal interpretation of the content of the conversation.
Why LanCologne?
In preliminary proceedings, the role of IT forensics is changing. It is no longer simply a matter of conducting an abstract review of the findings of an investigation. Technical examinations must now be specifically tailored to the charges and to those digital facts that may be relevant to the decision on whether to open the main proceedings.
LanCologne adopts a strictly open-ended approach in this regard. An adverse finding is confirmed if the data supports it. A counter-hypothesis is only presented as relevant if it is technically specific and remains consistent with the available evidence. Mere possibilities are distinguished from verifiable facts.
We place particular emphasis on the distinction between primary data and its interpretation, between a device, an account, a session and a natural person, and between technical feasibility and an actual, documented event.
The technical documentation is structured in such a way that a criminal defence lawyer can understand the significance of a finding without specialist forensic knowledge, and that another qualified IT forensic expert can verify the reasoning behind it on the basis of the documented sources.
How we work
Incriminating, exculpatory and inconclusive findings
The technical examination is not conducted with a specific outcome in mind. If an incriminating finding is confirmed, this is documented in the same way as a corroborating finding. If several explanations remain possible or if crucial data is missing, the conclusion is expressly left open. This distinction is essential, particularly for use in criminal proceedings.
Understandable to the defence lawyer and the court – technically verifiable
The key message is explained without unnecessary technical jargon. The technical section documents the key data sources, time references, identifiers, integrity information and investigative steps. This ensures that the reasoning remains verifiable by another qualified IT forensic expert.
LanCologne as an independent source of technical support for the defence
If digital evidence is to be examined following the filing of a charge, for the purposes of the decision to commence proceedings or to prepare for the trial, LanCologne provides support in the form of an objective and unbiased IT forensic examination. What matters is not the desired outcome, but what conclusions the available data actually support.
Legal framework
Once public prosecution proceedings have been instituted, the competent court shall decide, in accordance with section 199 of the Code of Criminal Procedure, whether to commence the main proceedings or to stay the proceedings provisionally. The indictment contains the application for the commencement of the main proceedings.
Under Section 201(1) of the Code of Criminal Procedure, the presiding judge shall serve the indictment on the accused and require him to state, within a period to be determined, whether he wishes to apply for the taking of specific evidence prior to the decision to open the trial or to raise objections to the opening of the main proceedings. The court shall rule on these applications and objections. Section 202 of the Code of Criminal Procedure (StPO) enables the court to order the taking of evidence in order to clarify the facts of the case.
Under Section 203 of the Code of Criminal Procedure (StPO), the court shall order the commencement of the main proceedings if, on the basis of the findings of the preliminary proceedings, there are reasonable grounds to suspect the accused of having committed a criminal offence. If this condition is not met, a decision not to commence proceedings under Section 204 StPO may, in particular, be considered. The legal assessment of these requirements is the responsibility of the court and the defence, not that of a privately commissioned IT forensic expert.
The right to inspect files and examine evidence continues to be governed by section 147 of the Code of Criminal Procedure and is vested in the defence counsel. Under Section 147(3), the defence counsel may not be denied access to expert reports at any stage of the proceedings. LanCologne does not acquire its own right of access to or inspection of files through a private commission.
The mere fact that an IT forensic expert has been privately commissioned by the defence does not, in itself, make them a formally appointed expert witness under sections 72 et seq. of the Code of Criminal Procedure. A distinction must be drawn between private expert reports, technical advice and formal appointment as an expert witness.
Once the main proceedings have commenced, the taking of evidence at the main hearing is governed in particular by section 244 of the Code of Criminal Procedure. Under section 244(2), the court must, of its own motion, extend the taking of evidence to cover all facts and evidence relevant to the decision. The conditions governing and the handling of formal applications for evidence are set out, in particular, in Section 244(3) et seq. LanCologne may prepare technical facts and issues; the procedural application must be made by the defence.
Frequently Asked Questions
LanCologne – IT Forensics for Lawyers & Criminal Defence Solicitors
Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.
Related to this topic
- How can the defence arrange for a check to be carried out to ensure that deleted messages were correctly interpreted during the preliminary proceedings?
- How can an alleged data leak be technically verified prior to the decision to open an investigation?
- How can the defence arrange for an investigation into whether remote access may have influenced the digital sequence of events alleged in the indictment?
- How can malware be investigated as an alternative cause of an alleged digital incident?