Digital evidence: a legal practitioner's perspective

Cybersecurity, much like traditional security, requires the collaborative effort of various stakeholders, including government, regulators, tech professionals, and legal practitioners. Each party must play their part effectively to achieve the objective of a cyber environment free from danger or threat. Ironically, legal practitioners who are responsible for prosecuting cybercrimes and administering justice face significant challenges in interpreting and applying the technical aspects of digital investigations. Existing research indicates that this difficulty largely stems from their predominantly non-technical background, which hinders their ability to fully grasp the implications of digital evidence. This research study aimed to investigate how employing analogies to traditional forms of evidence could aid legal practitioners in better understanding and applying the technical terms encountered in digital investigations. Building on existing literature on legal practitioners' digital awareness, this research study adopted a five-step methodological approach. First, a digital forensics report was analysed to identify technical terms. These technical terms were simplified and analogies to traditional evidence were constructed. These analogies were published via a website, and made accessible through a custom-built Microsoft Word add-in. A survey involving 16 participants was carried out to assess the value of the simplification provided by the analogies, and the impact was evaluated against Bloom’s taxonomy of cognitive learning. Results show that the analogies improved understanding of the digital forensics report and the way practitioners interpreted and applied technical terms found in the report.