Police Investigations, Social Media and Digital Evidence

In the digital age, most people have social media accounts on which they network with others. Due to the increase in social media use and online activity, the criminal justice system has had to keep up to date with technological advances prevalent in our day-to-day lives.

The Police are required to conduct thorough investigations and this can often involve enquiries into the online presence of a suspect, witness or a victim. This kind of evidence can include communications, direct messages or chat logs between the suspect and complainant or third parties. This can be particularly relevant in cases involving sexual or domestic allegations.  

Investigators and Prosecutors may also seek to consider:  

• Content of social media posts 
• Login history to track IP addresses and geolocation of a device 
• Details attached to a profile or social media account 

What evidence can the police look for?  

There must be checks and balances as to the powers the police and Crown Prosecution Service can exercise. Investigators and prosecutors must deal with digital evidence in an appropriate time and ensure it is handled correctly.  The police must follow Codes of Practice, legal guidelines and professional guidance when dealing with evidence. The police must ensure lines of enquiry are reasonable and proportionate. Where an investigator identifies a reasonable line of enquiry which involves consideration of a complainant’s electronic device, they must ensure that their mobile device is not taken possession of for longer than necessary to prevent unnecessary intrusion into a witness’s life.  

Therefore, it is less likely the police will take possession of a witness or complainant’s device. However, there is a different attitude towards a suspect’s mobile device. Upon arrest the police can, and often will, seize a suspect’s mobile phone in order to investigate the contents of it. In practice, forensic examination of a suspect’s device can take months to complete and in the most complex cases which require sophisticated examination, the investigation could last years.  

Can the police access deleted material?  

The police can access file or material which has been deleted from a device. However, the police may conduct a forensic examination of the device to access deleted data. The police must always consider if requesting a forensic examination of a device is a reasonable and proportionate line of enquiry. When files are deleted from a computer or device, the data does not disappear completely unless overwritten and therefore forensic experts can access the ‘left over’ data left by the deleted files. This can be particularly relevant in indecent image investigations.  

Levels of data extraction 

There are 3 levels of data extraction from mobile devices the police are able to conduct:  

Level 1  

This involves the extraction of data readily available on a device.  Deleted data cannot be extracted using level 1 “logical” extraction. This may involve the officer manually looking though the contents of a device for evidence they find relevant to the investigation or use of a basic software to extract the ‘live’ data from a device.

Level 2  

A higher level of sophistication of extraction may allow deleted data to be extracted. This is called “physical” extraction and is a more complicated method which takes longer to do. This would involve a forensic expert to conduct an investigation into the device. However, the amount of data which can be extracted depends on the kind of device and the application which has stored the data.  

Level 3  

More technical and sophisticated extraction can be conducted by forensic IT experts who apply their specialist evaluation and skills. The most sophisticated and comprehensive methods of data extraction may be able to retrieve data to be extracted from broken or damaged devices. 

Pre-charge engagement and digital material 

The Olliers pre-charge team of specialist lawyers are alive to the relevance of digital material. At Olliers we frequently utilise digital material which can assist a suspect, especially in the pre-charge engagement stage of an investigation. A range of digital evidence can be utilised to support an argument that the suspect should not be charged with an offence.  

Pre-charge engagement may include providing supportive digital material to the police on behalf of a suspect. In practice, this often includes providing the police message logs between a suspect and complainant, screenshots of social media posts and images and videos. Olliers may choose to direct the police to information or data held on a suspect’s phone seized by the police to assist the police to identify lines of enquiry away from the suspect. We can instruct forensic experts to conduct online intelligence research into a witness or complainant to provide a report and analysis of a subject’s online presence. At Olliers we frequently  instruct forensic digital experts to produce a defence report to investigate a device or data relied on by the prosecution.  

Contact our specialist pre-charge engagement lawyers 

If you would like to explore how Olliers can assist you, please contact our specialist team by telephone on 020 3883 6790 (London), 0161 834 1515 (Manchester), via email at info@olliers.com or complete the website form below and we will contact you for a confidential discussion.