IT Forensics · Solicitors & Criminal Defence Lawyers

How can the defence arrange for a review to be carried out to establish whether a technical possibility was treated as an established sequence of events in the judgement?

Judgements and investigation reports often contain phrases such as „technically possible“ or „it can be assumed that“. From a forensic perspective, possibility, probability and proof are three distinct concepts. The analysis reveals the level of certainty that the underlying data actually supports.

Enquire without obligation

Why this question is important for a criminal defence

Following a judgement or in proceedings before a higher court, a technical examination must not be conflated with the legal review of the appeal. However, it may be crucial for the defence to know precisely whether a digital statement is supported by the available primary data and whether a subsequent finding actually substantiates something new.

Technical background

The fact that an event was technically possible says nothing about whether it actually took place. Conversely, the absence of evidence is sometimes taken as proof that something did not happen – even though such evidence might not have been produced in the first place or might not have been preserved.

Relevant evidence and data sources

Expert opinions, reports and grounds for judgements containing technical findings
Underlying reports and, where available, raw data

Borders

It is up to the defence to assess the legal position and determine whether an appeal stands any chance of success.
Without raw data, the assessment is limited to checking the plausibility of the presentation.

Possible results

Classification of technical statements, with justification
Indications of invalid inferences from possibility to fact

Why LanCologne?

Following the conclusion of the first trial, the role of a defence-led IT forensic investigation changes once again. It is now essential to draw a clear distinction between the technical establishment of facts and the legal assessment of appeals or applications for a retrial.

Here’s how we do it

Identifying the key technical points.
Classification for each statement: proven, probable, possible, unproven.
A statement setting out the reasons based on the available data.

Incriminating, exculpatory and inconclusive findings

Even following a conviction or in the event of a possible appeal, the investigation remains open-ended. A previous incriminating finding is confirmed if the primary data supports it. A new counter-finding is only designated as such if its origin, integrity and technical significance are verifiably documented. Questions that cannot be resolved are not replaced by assumptions.

Understandable to the defence lawyer – technically verifiable

The main section explains the core technical message without using unnecessary specialist terminology. The technical section documents data states, backup times, identifiers, integrity values, artefact locations, time references and validation steps. This ensures that the investigation remains verifiable for another qualified IT forensic expert.

LanCologne as an independent source of technical support for the defence

Whether it is a preliminary investigation, interim proceedings, a trial or a subsequent technical examination: LanCologne answers the specific question regarding digital evidence objectively, without prejudging the outcome, and in a transparent manner. The benchmark is not the desired outcome, but solely what can or cannot be technically substantiated on the basis of the available data.

Legal framework

Once the main hearing has concluded, the court shall, in accordance with section 261 of the Code of Criminal Procedure, decide on the outcome of the taking of evidence in accordance with its free assessment, based on the substance of the proceedings. Section 267 of the Code of Criminal Procedure governs the content of the grounds for the judgement. A subsequent IT forensic examination can compare technical statements in the written grounds for the judgement with the available data and findings; however, it does not involve a legal review of the judgement.

Under section 312 of the Code of Criminal Procedure (StPO), an appeal may be lodged against judgements handed down by the criminal court and the lay judges’ court. The time limit for lodging an appeal is set out in section 314 of the Code of Criminal Procedure (StPO). The criminal defence lawyer assesses whether an appeal is permissible, admissible or advisable in the specific case. IT forensics can structure digital evidence in a professional manner to facilitate a fresh examination of the facts.

An appeal on points of law is governed by sections 333 et seq. of the Code of Criminal Procedure. Under section 337(1) of the Code of Criminal Procedure, it may only be based on the ground that the judgement is founded on a breach of the law. Section 344 of the Code of Criminal Procedure governs the grounds for an appeal on points of law and imposes specific requirements, in particular, on procedural objections. LanCologne does not formulate grounds for appeal and does not assess whether a technical circumstance constitutes a legal error that is subject to appeal. We merely document the technical factual basis for the defence counsel.

Sections 359 et seq. of the Code of Criminal Procedure (StPO) apply to the reopening of proceedings that have been concluded by a final and binding judgment in favour of the convicted person. Section 359 of the StPO sets out the statutory grounds for reopening proceedings. Whether a newly discovered digital data record, a device decrypted at a later date or new technical findings fulfil these conditions is a question of law. However, a digital forensics examination can determine whether the finding in question is authentic, technically new, relevant in terms of timing and compatible or incompatible with earlier findings.

This clear division of roles is essential: LanCologne provides technical facts, documents how they were arrived at and identifies the limits of their validity. The choice of legal remedies, time limits, requirements for raising objections, legal relevance and the submission of procedural applications remain entirely the responsibility of the defence.

Frequently Asked Questions

Does LanCologne examine whether a judgement is flawed in law?+

No. We examine only technical statements and the evidence on which they are based. It is for the defence lawyer or the competent court to determine whether this gives rise to a legal error.

Can new digital findings automatically justify a review of the case?+

No. First of all, a forensic examination can be carried out to determine whether the findings are authentic, genuinely new and technically relevant. The conditions set out in Sections 359 et seq. of the Code of Criminal Procedure are a legal matter.

Can LanCologne raise a point of appeal?+

No. We can document the underlying technical facts precisely and in a way that is easy to follow. It is the defence counsel’s responsibility to set out the grounds for the appeal.

Does the investigation remain open-ended even after a conviction?+

Yes. Even a subsequent audit does not necessarily serve to produce evidence to the contrary. An earlier finding is confirmed if the data supports it.

Will that help in the appeal proceedings?+

That is the defence’s assessment. Technically, we can demonstrate which findings are supported by the data.

Do you also review court reports?+

Yes, on methodological transparency and on the separation of findings and interpretation.

How long does an examination like this take?+

Depending on the volume of the file; you will receive an estimate once we have reviewed it.

LanCologne – IT Forensics for Lawyers & Criminal Defence Solicitors

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now