England and Wales criminal proceedings
Digital Forensic Expert Support for Criminal Defence
Independent review of police phone downloads, mobile extractions, computers, messages, video and other digital evidence for solicitors, counsel and defendants.
Direct access to Alistair Ewing · Legal Aid matters considered at authorised rates · Findings do not depend on the result
Independent criminal evidence review
Test the technical proposition, not simply the volume of data
A criminal defence digital forensics instruction often begins with served material that is much smaller than the underlying evidence. A schedule, screenshot, Streamlined Forensic Report, selected message sequence or extraction report may answer one question while leaving another unresolved. The first task is to identify the prosecution proposition, the defence issue and the records actually available for review.
Alistair can assess whether the supplied material supports the technical conclusion placed on it, whether material context is missing and whether a further targeted examination is proportionate. The evidence may support the prosecution account, the defence account, neither account, or a more qualified explanation. Fees are for the work and agreed output, not for a particular finding.
Instructions are accepted subject to conflict, competence, capacity, lawful authority and a workable timetable. Technical explanation is not legal advice. Decisions about case theory, admissibility, disclosure applications and how evidence is deployed remain with the legal team and the court.
Frequently instructed evidence
Phones, computers, messages and media
- Police mobile phone extraction review. Comparing the report, extraction, search results and source context relevant to a disputed message, file, contact, location or date.
- WhatsApp and messaging evidence. Examining sequence, participants, linked media, timestamps, database context and the limits of screenshots or selected exports.
- Computer activity. Testing browser, download, file, account, execution, storage and external-device records relevant to the allegation.
- Video and media provenance. Assessing supplied files, containers, timing, transcoding, export history and whether the material can support the stated interpretation.
- Review of another expert’s work. Checking source coverage, methods, assumptions, omissions, errors and the reasoning between an artefact and a conclusion.
- Targeted recovery or additional examination. Assessing whether deleted, omitted or inaccessible records may be recoverable and material to the instructed issue.
Material that helps at first review
Ask for the source behind the conclusion
- The served report, SFR, schedule or exhibit in which the digital finding appears.
- The prosecution statement or allegation the finding is said to support.
- Relevant defence instructions and focused questions approved by the legal team.
- The extraction type, associated reader, audit or processing information, and any supplied export.
- For video, the original supplied files and available information about acquisition and export.
- For computers, a forensic image or an agreed route to the original source where further examination is authorised.
- Known disclosure requests, responses, missing material and fixed court dates.
A PDF report is not the same thing as the data it summarises. Equally, possession of a large extraction does not mean every record is relevant or reliably attributable to the defendant.
Criminal procedure
Expert evidence under CrimPR Part 19
For proceedings in England and Wales, Part 19 of the Criminal Procedure Rules 2025 addresses expert evidence. An expert’s duty to the court includes objectivity and impartiality. The report must provide information needed to understand the expert’s competence, the basis of the opinion, relevant material relied on, the range of opinion where applicable, and any qualification to the conclusion.
The duty is not to construct the strongest technical argument for the party providing instructions. Material capable of detracting from an opinion has to be addressed, uncertainty explained and a question outside the expert’s competence identified.
Counsel’s advice, the indictment or a concise case summary can identify the propositions in issue. Technical questions should be answerable from evidence, such as whether a record exists, how it was generated, what time basis applies, what source it came from and what competing explanations remain. Credibility, guilt and the legal effect of a fact are not questions for a digital forensic examiner.
Regulatory boundaries
The forensic activity and purpose determine what applies
The Forensic Science Regulator Code of Practice, version 2, referred to here as the FSR Code, sets requirements for forensic science activities within its statutory scope. Whether a particular requirement, quality standard or accreditation expectation applies depends on the activity, purpose, setting and current regulatory position.
No blanket claim is made that every digital forensic service has the same status. The method, software, validation, review arrangements, limitations and any applicable declaration should be stated for the work actually undertaken. The Regulator’s guidance on interpretation and communication is also relevant to explaining evaluative conclusions and uncertainty.
Tool independence
A product report is the start of examiner review
Commercial forensic suites, open-source software, operating-system utilities, manual review and bespoke tools may all have a proper role. Alistair also develops his own tools. Selection depends on the evidence question, source, version, required output and validation need, rather than loyalty to one vendor.
A parser can make a large dataset reviewable, but its label is not automatically the evidential meaning of the source record. Significant results should be checked against underlying artefacts or another appropriate method where proportionate. Tool version, settings, errors and unsupported records can matter as much as the name on the report.
Illustrative criminal evidence patterns
Practical questions that call for source context
A message sequence in the served report appears incomplete. What can a review establish?
The extraction and reader may be checked for surrounding records, participants, attachments, message states, database identifiers, time conversion and search scope. Missing content may reflect deletion, retention, extraction limits or selection for the report. Absence alone does not establish suppression, and an apparent gap should not be filled with an assumed conversation.
A phone extraction links an account or record to the defendant. Does that prove who performed the act?
Device ownership, account identifiers and stored records can be important, but attribution may also depend on access by others, linked devices, account compromise, synchronisation and the wider chronology. The examiner should state what the technical data identifies and where a conclusion about the human actor needs other evidence.
Only an SFR or selected screenshots have been served. Is that enough for an expert review?
It may be enough to identify a focused concern, but not to resolve it. The underlying extraction, native media or forensic image may be required to test the finding. A useful preliminary opinion can state what can be assessed from the served material, what cannot, and which additional source would make a material difference.
A video file has passed through editing or disclosure software. Is it no longer useful?
Not necessarily. The supplied container, encoding, frame structure, timestamps and visible content may still answer limited questions. Transcoding or export can remove metadata and alter timing behaviour, so the opinion must distinguish the content observed from claims about the original recorder, creation process or precise timing.
The material cannot be released from a police or provider environment. Can it still be reviewed?
Sometimes a controlled on-site review can be agreed, including work at a digital forensic unit or through an authorised provider. The arrangement must allow enough access to inspect the relevant source, record the method and retain reviewable notes or outputs. Restrictions that prevent independent checking have to be reported as limitations.
How a staged criminal instruction can work
- Conflict and deadline check. Provide party names, the next hearing or report date and the proposed funding route.
- Focused preliminary material. If suitable, a secure route is agreed for the limited report or schedule needed to scope the issue.
- Itemised estimate. The estimate identifies assumptions, evidence needed, proposed stages, likely hours, output and delivery dependency.
- Review or examination. Work is confined to the agreed questions unless a material issue requires revised instructions.
- Advice or report. Findings and limits are stated for the instructed purpose, with supplementary work agreed separately.
Time and funding
Urgent work can sometimes be prioritised, but availability, evidence access and time for a responsible examination have to be checked. A trial date does not make an incomplete source complete or remove the need to verify a significant finding. If the date cannot responsibly be met, that will be clear before acceptance.
Legal Aid instructions are considered at authorised Legal Aid Agency rates. Prior authority, page or hour limits, travel and any change of scope should be addressed by the instructing solicitor. See the current Legal Aid Agency guidance for expert witnesses.
For privately funded instructions, payment stages and funds required on account are stated in the written estimate and terms. No fee depends on acquittal, exclusion of evidence, recovery of data or another case result.
Computer Misuse Act expert evidence
An allegation of unauthorised access needs more than a list of unfamiliar IP addresses or installed programs. A technical review can test the recorded sessions, commands, account permissions, remote access and changes relied on, then compare them with the proposed chronology and available source material.
Attribution needs care where accounts are shared, access is remote or activity can be automated. Alistair can explain what the computer evidence supports and the alternatives it leaves open. Legal authorisation, intent and guilt are not decided by the forensic tool or examiner. See the CPS guidance on the Computer Misuse Act for legal context, and computer forensic examination for source-specific work.
Deadline and conflict check first
Discuss a digital forensic question in a criminal case
Send party names, the allegation, the technical proposition to be tested, a description of the served material, funding route and every fixed date. Do not attach case papers or extraction data to the public enquiry. A secure route follows only if the matter can proceed.