IT Forensics · Solicitors & Criminal Defence Lawyers

How can the defence prepare, from an IT forensics perspective, for the taking of digital evidence during the trial?

Digital evidence only comes into its own during the main hearing once it has been specifically examined and assessed. The defence should therefore know in advance which technical findings are undisputed, which require explanation, and which are open to technical challenge.

Enquire without obligation

Why this question is important for a criminal defence

In the main hearing, it is not the volume of technical data that is decisive, but the reliability of the evidence that has actually been presented and assessed. The defence must therefore be able to recognise what information a digital artefact conveys, what conditions apply to it, and where interpretation begins.

Technical investigative approach

We organise the key digital findings, link them to the raw data, and prepare any outstanding technical questions and counter-evidence for the defence.

Where the limits of what can be said lie

LanCologne does not determine either the conduct of the taking of evidence or the defence strategy in the proceedings. We provide the technical factual basis.

Why LanCologne?

During the main hearing, digital evidence must not only be technically accurate, but its actual scope must also be made clear. This is precisely where the role of independent IT forensic support for the defence comes in.

LanCologne does not carry out its assessments with the aim of refuting a court-appointed or regulatory expert. The key consideration is whether the data set, methodology and conclusion are consistent. If a finding is substantiated, it is confirmed. Where technical limitations, contradictory primary data or plausible alternative explanations exist, these are also clearly documented.

Particular attention is paid to the distinction between automated parser representations and raw data, between devices, accounts, sessions and natural persons, and between technical possibilities and events that have actually been verified.

The findings are presented in two stages: in a way that is clear to the defence and the court, whilst also providing sufficient technical detail to enable another qualified IT forensic expert to verify the key findings.

How we work

Incriminating, exculpatory and inconclusive findings

Technical support is not geared towards a desired outcome of the proceedings. A finding that is technically incriminating is stated just as clearly as a finding that is exculpatory. If a question cannot be resolved on the basis of the available data, this fact is specifically documented. Such an open-minded approach to findings is a prerequisite for credible forensic work.

Understandable to the defence and the court – technically reproducible

Key points are explained without unnecessary technical jargon. The technical section documents data sources, identifiers, time references, integrity information, artefact locations and validation steps. This ensures that the reasoning behind the findings can be technically verified by another qualified IT forensic expert.

LanCologne as an independent technical support service during the main hearing

Where digital evidence, IT forensic reports or expert witness statements need to be professionally prepared or reviewed for the main hearing, LanCologne supports the defence with a transparent and unbiased technical analysis. What matters is what the data actually proves – and what cannot be reliably deduced from it.

Section 244 of the Code of Criminal Procedure (StPO) is of particular importance for the taking of evidence at the main hearing. Under Section 244(2), the court must, of its own motion, extend the taking of evidence to all facts and evidence relevant to the decision. The legal requirements for applications for evidence and their rejection are set out, in particular, in Section 244(3) et seq. of the Code of Criminal Procedure. The legal formulation and submission of an application for evidence is the responsibility of the defence lawyer, not of a privately commissioned IT forensic expert.

Sections 72 et seq. of the Code of Criminal Procedure (StPO) apply to expert evidence. An IT forensic expert privately commissioned by the defence does not, by virtue of that commission alone, become an expert formally appointed by the court. These roles must be strictly separated.

Section 244(4) of the Code of Criminal Procedure (StPO) sets out specific rules governing the rejection of a motion to call an expert witness. Under the conditions laid down by law, the hearing of a further expert witness may, in particular, be relevant. In addition, Section 83 of the Code of Criminal Procedure (StPO) provides for the possibility of a new expert report in the circumstances specified therein. Whether these conditions are met in the specific case is a matter of criminal procedure to be determined by the defence and the court.

Section 245 of the Code of Criminal Procedure contains specific rules on the taking of evidence in relation to evidence produced and persons summoned or appearing in court. Whether the provision applies to a specific piece of digital evidence or a specific procedural situation must be assessed on a case-by-case basis.

The defence counsel retains the right to inspect the case file in accordance with Section 147 of the Code of Criminal Procedure. LanCologne does not acquire any procedural powers of its own through a private commission. Our role is to carry out a technical examination of digital evidence, prepare technical matters and clearly set out the limitations of any testimony.

Frequently Asked Questions

LanCologne – IT Forensics for Lawyers & Criminal Defence Solicitors

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now