Renaming Digital Evidence

[Kats41]

I'm a software dev for a law enforcement technologies firm and we're currently developing an evidence management software for smaller police departments. We're anticipating clients in all states, so there's no real district I can limit the scope to.

One of the concerns my supervisor had about file handling when databasing the evidence was renaming the files and whether or not a lawyer could actually argue that renaming a file would constitute evidence tampering and that it wasn't valid. Since we don't exactly know how other software solutions save and index data, we don't have a very good reference to work from.

Is this a legitimate concern for law enforcement officers when saving videos and images to their computers for management or are we worrying about microscopic details that no judge would care for?

I understand that this isn't a traditional "legal advice" question, but knowing the limitations of what a defender can argue will help us greatly when coming up with possible database solutions.

 

[FlyingRon]

You should be accumulating some journal of EVERY STEP performed on a piece of data you intend to claim as evidence. This would include any change made to the file, what was changed, who did it, and when. This includes renaming it, moving it to other storage devices, as well as actual changing of the file contents.

 

[Zigner]

You will want to ask your own corporate legal counsel, not an internet forum. Really.

 

[Kats41]

Thanks.

Hopefully we'll get a legal consultant soon, but it's still very early in development and it hasn't really been seen as a point of concern just yet to anyone but myself, really. That and we're a fairly small company. I'm literally one of two software devs in-house, so we don't exactly have a huge "corporate legal staff" at our disposal. Lol. We are using an audit log for any changes or accesses to the files.

The reason I wanted to change the name of the files in the first place was more because I personally don't trust the file naming practices of many recording devices such as body and dash cams, since the majority just name files off of times stamps. While slim, since there is the chance that two files could be databased with the same filename and cause overwrite issues, that's the exact issue that I'm attempting to avoid, but my supervisor is worried about evidence maintenance.

 

[Zigner]

Thanks.

Hopefully we'll get a legal consultant soon, but it's still very early in development and it hasn't really been seen as a point of concern just yet to anyone but myself, really. That and we're a fairly small company. I'm literally one of two software devs in-house, so we don't exactly have a huge "corporate legal staff" at our disposal. Lol. We are using an audit log for any changes or accesses to the files.

Your type of business, no matter HOW small, can't afford to be run without legal counsel.

The reason I wanted to change the name of the files in the first place was more because I personally don't trust the file naming practices of many recording devices such as body and dash cams, since the majority just name files off of times stamps. While slim, since there is the chance that two files could be databased with the same filename and cause overwrite issues, that's the exact issue that I'm attempting to avoid, but my supervisor is worried about evidence maintenance.

You do understand the use of folders, right? You're not storing every file in the same folder...you should never have any issues with files being overwritten if you properly manage your file & folder organization.

 

[Kats41]

Your type of business, no matter HOW small, can't afford to be run without legal counsel.

You do understand the use of folders, right? You're not storing every file in the same folder...you should never have any issues with files being overwritten if you properly manage your file & folder organization.

We partition the files by date, but that obviously that doesn't solve the filename issue if it's the time stamp of creation.

With that said, obviously I know how to use folders (probably better than you do, honestly), but my question wasn't on folders, it was on the legalities of file renaming.

It's also not my decision whether or not we have a legal consultant on staff (believe me, I've asked multiple times already), so I'm left using the tools that I have access to, simple as that.

I'm literally just trying to get a simple answer to a simple question, not discuss workarounds. Sorry. (Then again, we're talking law, here, so I suppose nothing is simple black and white)

 

[FlyingRon]

Again, you will need to be able to record every change to the file to include it's name and location on the computer (whether you consider the file name and enclosing folder to be part of the name or part of the storage is really an unrelated filesystem implementation detail). Any time you or the system even BREATHES on the file, that needs to be recorded. You need a procedure to audit this as well. The issues here are not nebulous, but it's WAY OUTSIDE OF THE SCOPE OF THIS FORUM. While you should have legal counsel in general, you also should have some technical advice on digital evidence management. It's a specialized quasilegal technical area. You can get a smattering of what is involved if you just google the term.

 

[Zigner]

It's also not my decision whether or not we have a legal consultant on staff (believe me, I've asked multiple times already), so I'm left using the tools that I have access to, simple as that.

Then I would suggest that you have ready access to personal legal counsel for the inevitable time that someone attempts to hold you personally liable for something related to your work.

 

[FlyingRon]

Then I would suggest that you have ready access to personal legal counsel for the inevitable time that someone attempts to hold you personally liable for something related to your work.

Let's put it this way. Your customer in a criminal case will be hauled into court and questioned by ATTORNEYS about what your computer program is doing. You may be similarly hauled into court on that case and questioned by ATTORNEYS about what your computer program is doing. If the resulting action doesn't come out in favor of your customer, you may find your company and yourself being hauled into civil court facing ATTORNEYS who are going to be asking you questions about what you did and who may be persuing monetary judgements against you.

It behooves you to get some professional help of your own early on.

I've done a little work for a police software company myself. I've done even more work tracking CLASSIFIED information in computers and computer networks (don't get me started about Clinton). This is a specialized field. You need specialized help.

 

[CavemanLawyer]

Honestly I think you are scrutinizing over a minor detail. Unless the filename is actually part of the evidence itself (files seized from a computer) then it doesn't matter. No witness will ever look at a digital file and use just the filename to identify it in court. The witness will have viewed the content in advance and then authenticate the item based on that. As an attorney I relabel digital evidence all the time before burning my court exhibit. Most digital files that come from agencies have names that mean nothing outside of the computer program... like the agency case number followed by random characters. Juries don't like that so it instead gets re-labled as "Officer Steven's in-car." What I do see in most cases from agency produced evidence is a simple PDF document auto generated with the export which shows a file integrity verification of some sort, date it was exported, and of course the filename that was used for export. Or that information will be displayed in the playback software on the disc. With this information it is trivial to verify its accuracy compared to original digital file which is presumably still stored on the main server. And all of that info generally is then omitted for the court exhibit anyway. I have access to plenty of law enforcement generated evidence all the time (in-cars, body cams, interviews) if you want me to generally describe how the output looks.

I don't know specifically how your software will function but one piece of advice that I would strongly consider is to have some easy way to export to MP4. Most appellate courts today are requiring that digital video be uploaded to them in MP4 format instead of physically sending the court exhibit via mail. Counties are in turn passing local rules requiring MP4. District attorney's offices and defense attorneys are having to manually convert it to MP4 before offering it for those items that come in a different format. Most law enforcement generated evidence I see comes with a software player on the disc that plays the file with any additional corresponding data like GPS coordinates, vehicle functions, additional audio/video channels, etc. The master software used by the agency has an export function that can give you an MP4 file but the playback software included on each disc does not and it is a major pain in the butt. It would be ideal if the file stored on the disc were already in MP4. If that's not possible then it'd be nice to have the ability to export to MP4 yourself. Without these functions attorneys have to either convert it themselves or request multiple copies from the agency, one in MP4 and one with all the bells and whistles, which is very inefficient.

 

[FlyingRon]

I don't think it's an obsessive detail. You would take a piece of physical evidence and put it in a new container without making a notation somewhere that it was placed there (or what was placed within). You need these records if you are ever called to testify about the evidence. The digital file is no different. And indeed, the filename in computer evidence can be part of the evidence itself, but even if not, it behooves you to have auditable records.