IT Forensics · Solicitors & Criminal Defence Lawyers

How can the defence determine whether any relevant data has been excluded by filters during the analysis?

Official analyses using tools such as Cellebrite, AXIOM or X-Ways almost always employ filters: time periods, file types, categories, search terms. Whilst this is methodologically correct, it can result in exculpatory data never appearing in the report. The cross-check examines what fell outside the filters.

Enquire without obligation

Why this question is important for a criminal defence

Having examined the case files, it is important to distinguish the technical facts from the summary assessments of the investigation. Digital evidence, in particular, can appear plausible in reports, even though the scope of data extraction, temporal context, attribution to individuals or data context may require a more nuanced assessment.

Technical background

Typical gaps arise due to time windows that are too narrow (incorrect time zone), excluded data sources (deleted sections, cloud artefacts, apps without parsers), category filters (e.g. „images“ only) or keywords without variants and typos.

Relevant evidence and data sources

  • Report configuration and export logs for the analysis tool
  • Extraction report (scope, type of backup, errors)
  • Hash values and control flow
  • Where applicable, the raw data or the image itself, if available

Borders

  • Without access to the raw data, only the methodology can be checked, not the hidden content.
  • A filter is not automatically flawed; what matters is how it relates to the question at hand.

Possible results

  • Documentation of the filters used and their effects
  • Identification of data areas that may not have been taken into account
  • Guidance on how to phrase suggestions for evidence

Why LanCologne?

Having examined the case files, the added value of an independent IT forensic review does not lie in casting blanket doubt on the work carried out by the authorities. Rather, the key point is to trace the key digital findings back to their actual data sources.

Here’s how we do it

  • Identification of the filters applied from the file and report.
  • Assessment in the light of the specific facts of the case and the defence’s arguments.
  • If raw data is available: targeted inspection of the obscured areas.
  • A statement containing specific suggestions for review.

Incriminating, exculpatory and inconclusive findings

A technical review is not an attempt to find an error in the investigation file at all costs. Technically correct findings are confirmed. If contradictory findings, incomplete data or alternative technical explanations are identified, these are also documented in a clear and comprehensible manner. This provides the defence with a realistic and robust factual basis.

Understandable to the defence lawyer – reproducible for other forensic scientists

The main finding is formulated clearly and without unnecessary technical jargon. Data sources relevant to the investigation, hash values, IDs, time references, raw data locations and methodological steps are documented in such a way that another qualified IT forensic expert can technically verify the key findings.

LanCologne as an independent source of technical support for the defence

If a criminal defence lawyer wishes to have a digital key analysis independently verified after reviewing the case files, LanCologne provides support in the form of an objective and unbiased IT forensic re-examination. The aim is to provide a clear answer as to what the available technical data actually proves – and what it does not.

Legal framework

The defence counsel’s right to inspect files and examine exhibits is governed by section 147 of the Code of Criminal Procedure. Under paragraph 1, the defence counsel is authorised to inspect the files before the court or, in the case of an indictment, those to be submitted to the court, and to examine exhibits held in official custody. So long as the conclusion of the investigations has not yet been noted in the files, access or inspection may, pursuant to paragraph 2, be restricted subject to the conditions set out therein. Under Section 147(3), the defence counsel must not, in any stage of the proceedings, be denied access to expert reports. In the preliminary proceedings, the public prosecutor’s office generally decides on the granting of access to the files (Section 147(5)).

These rights are vested in the defence counsel, not in LanCologne. A technical cross-check therefore requires that the defence be able to lawfully make the relevant documents or data available. By being privately commissioned, LanCologne does not acquire any right of its own to inspect, examine files or access information held by the Crown Prosecution Service or the police.

Section 160(2) of the Code of Criminal Procedure (StPO) requires the public prosecutor’s office to investigate both incriminating and exculpatory circumstances. Under Section 163a(2) of the StPO, evidence requested by the accused in their defence must be obtained if it is relevant. An independent technical examination can therefore provide factual evidence which the defence counsel can assess with a view to suggesting further evidence or making applications; the procedural decision is taken by the defence counsel or the competent law enforcement authority.

Insofar as electronic evidence that has been officially seized, confiscated or examined is concerned, particular attention must be paid to sections 94, 98 and 110 of the Code of Criminal Procedure. Section 110(3) governs the examination of electronic storage media by authorised state authorities and, subject to certain conditions, also storage media located in separate premises. This does not confer any sovereign powers on a privately commissioned IT forensic expert.

An IT forensic expert privately engaged by the defence is not, by virtue of that engagement alone, a formally appointed expert witness within the meaning of Sections 72 et seq. of the Code of Criminal Procedure. These procedural roles are expressly distinguished from one another.

Frequently Asked Questions

Can LanCologne itself request access to the case files under section 147 of the Code of Criminal Procedure?+
No. This right is vested in the defence counsel or, subject to the statutory conditions, in the accused. LanCologne can only carry out technical checks on case files and data that have been lawfully made available.
Does the cross-check assume that the official assessment is incorrect?+
No. The assessment is open-ended. Key findings may be confirmed, qualified or technically refuted.
Does the entire forensic investigation have to be repeated for every report?+
Not necessarily. The scope depends on the specific defence argument and on which technical findings are actually crucial to the charge.
Can LanCologne assist the defence lawyer in referring technical queries to an expert?+
Yes. We can identify technical inconsistencies, gaps in the evidence and limitations in testimony, and use these to draw up a list of technical questions. It is up to the defence lawyer to decide how to use these in court.
How can I tell from the file that it has been filtered?+
Report details such as time period, categories or search terms. These details are often missing – that, too, is a finding.
Can you assess the agency’s reputation?+
If it is lawfully made available to the defence, then yes.
Is that a criticism of the police?+
No. The question is whether the data supports the conclusion.

Related topics

LanCologne – IT Forensics for Lawyers & Criminal Defence Solicitors

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now