Digital forensics and legal guarantees for the accused in an electronic environment

The article is devoted to a comprehensive analysis of the criminal procedural aspects of using digital (electronic) evidence and electronic information carriers in criminal proceedings, a highly relevant topic given the rapid development of digital technologies and their penetration into all spheres of society. The modern criminal offense almost invariably leaves its digital trace in the form of mobile device data, information from cloud storage, IP addresses during internet communications, or activity on social networks, all unified under the concept of digital evidence (electronic information) which holds crucial significance in the evidentiary process. The research examines the insufficient adaptation of the current norms of the Criminal Procedural Code (CPC) of Ukraine, which creates systematic obstacles to ensuring the legality, reliability, and admissibility of the electronic information obtained. The author conducts a theoretical analysis of the legal nature of digital (electronic) evidence and establishes its hybrid procedural nature, which combines the features of both a document and material evidence, complicating uniform application of the law. To overcome this legal conflict, original, scientifically grounded definitions are proposed for potential inclusion in the CPC of Ukraine. Specifically, it is proposed to formulate the concept of “digital (electronic) evidence” in Article 99 of the CPC as: “factual data about circumstances subject to proof in criminal proceedings, created, transmitted, stored, or extracted in a form suitable for perception and processing by a computer system, regardless of their physical location, provided that the procedure for their integrity and authenticity is adhered to”. The physical location of such digital (electronic) evidence may include electronic carriers, computer networks, cloud storage, or information and telecommunication systems. Furthermore, to avoid confusion, it is proposed to define the concept of “electronic information carrier” as: “a material object (device, hardware, or software-hardware complex) intended for the creation, collection, storage, processing, reproduction, or transmission of digital (electronic) evidence, which may be seized as material evidence in criminal proceedings”. Particular attention is devoted to practical challenges arising during the stages of collection, recording, and storage of digital evidence during searches and temporary access, especially concerning data extracted from mobile devices, social networks, and cloud storage, where information is most vulnerable. It is substantiated that, to ensure the admissibility of digital evidence, a legislative requirement for the mandatory application of cryptographic protection methods at the stage of their recording is necessary. This will ensure their authenticity and must be reflected in the protocols of investigative actions and the rulings of the investigating judge. Emphasis is placed on the critical importance of maintaining the chain of custody, as digital evidence requires ensuring the integrity (inviolability) of the information itself, and not merely the physical carrier. A legislative requirement is proposed for the creation of secure digital repositories or specialized electronic storage facilities within pre-trial investigation bodies for the proper storage of large volumes of data obtained under investigating judges’ rulings. The importance of maintaining the authenticity of digital (electronic) evidence to ensure its relevance and admissibility when appended to the criminal case materials and during subsequent consideration in the court of first instance is underscored. The conclusion emphasizes that adapting procedural norms to digital realities is a critically necessary condition for creating a unified conceptual apparatus and procedural standards that will ensure the legality, fairness, and effectiveness of modern criminal proceedings.

In the context of digital transformation, electronic evidence plays an extraordinarily important role in criminal proceedings. The development of information technologies and the widespread use of digital communications have significantly altered the nature of evidence that can be used in legal proceedings. Electronic evidence encompasses a wide range of digital information, including emails, mobile device data, computer files, video recordings, surveillance camera footage, social media data, and other forms of electronic information. These pieces of evidence are crucial for establishing facts of a crime, as well as identifying the subject, circumstances, and consequences of a criminal offense. This article provides a comprehensive analysis of the concept of electronic evidence, its classification, and the peculiarities of legal regulation in various countries around the world. Special attention is given to countries such as the United States, the United Kingdom, Canada, Australia, Germany, and Japan. A comparative analysis of legal norms regulating the use of electronic evidence in these countries is conducted, allowing for an examination of different approaches to the collection, preservation, authentication, and use of digital evidence. Each of the countries analyzed has its own specific requirements and procedures related to electronic evidence, but a common trend is observed—the need to ensure the reliability and authenticity of data. The study addresses key issues related to the use of electronic evidence, such as ensuring its procedural admissibility, protecting human rights during the collection and use of data, and addressing issues of confidentiality and data security. Specifically, the article analyzes the authentication of electronic evidence, as well as its compliance with procedural requirements established by national and international norms. The article also provides a detailed examination of legislative approaches to electronic evidence in different jurisdictions. In the United States, the Federal Rules of Evidence play a key role in defining procedures for establishing the credibility of digital data, while in the United Kingdom, the Criminal Justice Act 2003 regulates the admissibility of electronic evidence in court. Canadian legislation, including PIPEDA and the Criminal Code of Canada, establishes strict requirements for the collection and processing of electronic evidence. In Australia, important provisions are contained in the Electronic Transactions Act 1999, which regulates the use of electronic documents in legal proceedings. In Germany, the Strafprozessordnung (Code of Criminal Procedure) provides rules for electronic evidence, while in Japan, laws related to confidentiality and information security in the digital environment play a significant role. The article also highlights issues related to international cooperation and the harmonization of legal norms between countries, particularly in terms of exchanging electronic evidence and recognizing its validity within international legal frameworks. The balance between ensuring the security and confidentiality of information and the rights of individuals affected by such evidence is also discussed. Recommendations are made for improving the legal framework, adapting national legislation to the challenges of the digital age, enhancing the effectiveness of international cooperation in this field, andcreating universal standards for the collection and analysis of electronic evidence.

The article summarises the scientific developments regarding the concept and essence of electronic evidence and provides the author’s own definition to the concept of “electronic (digital) evidence” in criminal proceedings; examines the regulatory framework for the use of electronic (digital) evidence in criminal proceedings; analyses the investigative and judicial practice and the practice of the Supreme Court regarding the admissibility of such evidence in criminal proceedings. It has been admitted that today the problem of regulating electronic (digital) evidence is relevant. The analysis of the Criminal Procedure Code of Ukraine makes it possible to understand that electronic (digital) evidence has almost no legal regulation, which negatively affects the quality and effectiveness of criminal proceedings. As a result, a number of legislative contradictions arise. Unlike other procedural laws (commercial, civil and administrative), criminal procedural legislation does not contain any provisions on electronic (digital) evidence. At the same time, there are positive trends at the legislative level to recognise the need to regulate electronic (digital) evidence in criminal proceedings. It has been determined that today there is no unified approach among scholars to understanding the concept, features and place of electronic evidence in the system of sources of evidence in criminal proceedings. It is proposed to use the term “electronic (digital) evidence” at the legislative level. This is substantiated by the fact that “electronic” indicates the type of device with which the evidence was created and stored, and “digital” refers to the type of recording the formation on the relevant device. The analysis of investigative and judicial practice has highlighted the ambiguity in the understanding of law enforcement officers regarding the collection of electronic evidence. This issue was the subject for consideration by the judges of the Criminal Court of Cassation of the Supreme Court (in particular, the procedure for assessing electronic evidence and its admissibility was explained in the decision of the Joint Chamber of the Criminal Court of Cassation of the Supreme Court dated 29 March 2021 in case No. 554/5090/16-к). Taking into account international experience in collecting electronic (digital) evidence allows the use of the Berkeley Protocol in criminal proceedings in Ukraine, as it is actively used by the international community and is relevant in the context of russia’s armed aggression against Ukraine.

This white paper examines the use of modern technology as evidence in criminal proceedings in Jordan and its impact on basic freedoms in the country's legal framework. The paper begins by providing an overview of the Jordanian legal system and the importance of criminal evidence in criminal proceedings. It then explores the limitations of traditional evidence and the increasing importance of modern technology as evidence in criminal investigations.
 The paper further examines the types of modern technology used as evidence in Jordan, including digital data and social media, and the admissibility of such evidence in criminal proceedings. The advantages and disadvantages of using modern technology as evidence are also analysed, along with the potential impact on basic freedoms such as the right to privacy, freedom of expression, and the right to a fair trial. Finally, the paper offers recommendations for future developments in legislation to ensure a balance between the benefits of modern technology in criminal proceedings and the protection of individual rights and freedoms. Overall, this paper highlights the importance of evaluating the use of modern technology as evidence in criminal proceedings to ensure a fair and effective criminal justice system that respects the rights and freedoms of individuals in Jordan.

The article is devoted to the study of the place and photographs of electronic evidence in criminal proceedings. It is noted that with the advent of information and computer technology (smartphones, tablets, laptops, etc.), which criminals began to use for their illegal purposes, a new type of evidence began to appear – electronic evidence. Among domestic scientists there is no unity of opinion on the definition of the concept, place and electronic evidence in criminal proceedings. This is due not only to the lack of regulatory consolidation of electronic evidence in the Criminal Procedure Code of Ukraine (CPC of Ukraine), but also to the specification of their organization, research, seizure, storage and evaluation. It is emphasized that the CPC of Ukraine does not contain a definition of the concept of “electronic evidence”, but it is given in the Code of Administrative Procedure of Ukraine (CAP of Ukraine), the Commercial Procedure Code (CPC of Ukraine) and the Civil Procedure Codes of Ukraine (CPC of Ukraine) The article uses the concept of “electronic evidence after”, in international regulatory acts, in particular in acts of the European Union, the term electronic evidence (electronic evidence) is mainly used. A comparative analysis of approaches to consolidation and regulation of electronic evidence in the legislation of foreign countries, in particular Latvia, Hungary, Singapore, Great Britain and the USA, is presented. Both national and foreign judicial practice are given in detail. Proposals have been made regarding the possible consolidation of electronic evidence in the criminal procedural legislation of Ukraine in two ways, namely: consolidation of the concept of electronic evidence in the Code of Criminal Procedure of Ukraine, establishing its definition and indicating what exactly can be attributed to electronic evidence and creating a separate law that will determine the procedure for research, collection, storage and analysis of electronic evidence. Establishment of clear and understandable procedures for the admissibility and admissibility of electronic evidence in criminal proceedings.

Collection of digital evidence is relevant in the majority legal proceedings in some way. In criminal proceedings, the public authorities have powerful legal measures at their disposal that allow collection of evidence, but often these measures are not specifically designed to deal with digital evidence. Besides the problem of suitability of traditional evidence rules, law enforcement also has to deal with higher legal standards and often work together with the private sector. Moreover, the practical use of existing special powers addressing digital evidence (like the ones set forth in the CoE Cybercrime Convention) still needs a lot of encouragement. On the other hand, collection of digital evidence in a civil law suit follows different principles; parties have less control over the process but have more flexibility, and following the “meet and confer” principle can establish better tailored rules for their case. However, failure to properly manage preservation and collection of digital evidence may lead to unfavourable outcomes in legal proceedings and end up in getting fines or disruption of business functions and processes. This article discusses issues relating to collection of digital evidence in criminal proceedings, civil cases, arbitration and other legal purposes in order to identify areas where private sector actions can inform law enforcement efforts and vice versa while outlining a model for legal requirements of digital forensic readiness.

The article analyzes the case law on the admissibility of digital evidence in criminal proceedings. It is noted that in the digital age, digital evidence has become a useful tool in criminal proceedings. It is established that, unlike the Civil Procedure Code of Ukraine, the Commercial Procedure Code of Ukraine and the Code of Administrative Procedure of Ukraine, the Criminal Procedure Code of Ukraine does not contain any mention of electronic evidence, and in criminal procedural doctrine and practice, electronic evidence, depending on its content, form and purpose of creation in criminal proceedings, is referred to as material evidence or documents. The author emphasizes that when analyzing the provisions of Articles 87, 88, 88-1, 89 of the CPC of Ukraine, the legislator pays attention to the inadmissibility of evidence, leaving out the procedure for obtaining and recognizing the admissibility of evidence. The author emphasizes that it is controversial to determine the criteria (conditions, requirements, rules, elements) of evidence admissibility in criminal proceedings and supports, in the authors' opinion, the most extended view of such classification. The author analyzes the case law on the admissibility of digital evidence in criminal proceedings on the basis of specific court rulings. The author considers the position of the court in the decision of the Joint Chamber of the Criminal Court of Cassation of the Supreme Court of March 29, 2021 in case No. 554/5090/16-к, proceedings No. 51-1878кмо20 and notes that the court recognized electronic documents (flash drives No. 1386 and 1387) as digital evidence, copies of digital information instead of its originals as admissible digital evidence. There is also a practice of non-recognition of digital evidence as admissible in the decision of the panel of judges of the First Judicial Chamber of the Criminal Court of Cassation of the Supreme Court of May 29, 2018 in case No. 397/2588/13-к, proceedings No. 51-3650km18, and the decision of the Supreme Court of the panel of judges of the Criminal Court of Cassation of March 17, 2020 in case No. 426/12149/17, proceedings No. 51-112km20. It is concluded that the ambiguous approach of judges to the admissibility or inadmissibility of digital evidence in criminal proceedings indicates the existence of gaps in the Criminal Procedure Code of Ukraine. In many cases, the validity, reliability, completeness, authenticity and reliability of digital evidence in a particular case depends on its recognition by judges as admissible. The author proposes amendments and additions to the Criminal Procedure Code of Ukraine. Keywords: admissibility, evidence, digital technologies, electronic evidence, digital evidence, Criminal Procedure Code of Ukraine, criminal proceedings.

The development of information technology, along with its indisputable advantages, has brought to our lives a number of negative phenomena related to the illegal use of computers and telecommunications. However, the issue of using digital information as evidence in the criminal procedural legislation of Ukraine remains almost unsettled, in particular, the place of digital evidence in the system of procedural sources of evidence (digital evidence is difficult to unambiguously attribute to material evidence or documents) remains unclear. Criminal proceedings raise problems regarding the correct assessment of digital (electronic) evidence for their identity and admissibility, which certainly does not contribute to the effective use of digital technologies and sources of information in national proceedings. The purpose of the article is to research the problematic issues of determining the appropriateness and admissibility of digital (electronic) evidence during criminal proceedings, as well as to identify and disclose individual principles for their proper procedural evaluation. The research deals with the current state of theoretical studies of the issue of the appropriateness and admissibility of digital evidence both in Ukrainian criminal procedure science and abroad. The peculiarities of the requirements for the assessment of traditional evidence and digital evidence in criminal proceedings are analyzed. The author identifies the features of obtaining (collecting) digital evidence, given their intangible nature, with a view to their further positive evaluation by admissibility and appropriateness criteria. Taking into account the international experience, the author concludes that there is a need to distinguish separate principles of admissibility and availability for digital evidence, revealing their content. The urgent need to settle this issue, both at the legislative level and through appropriate judicial clarification, is substantiated. It is emphasized that in view of the specific nature of digital (electronic) evidence to ensure their authenticity and reliability in criminal proceedings is associated with the promptness of investigative actions, mandatory involvement of an expert, professional training of all subjects of evidence and steady adherence to recommendations for working with digital evidence.

This chapter explores the intersection of digital forensics and artificial intelligence (AI), emphasizing the transformative impact AI is having on digital investigative techniques. Digital forensics, traditionally focused on the collection, preservation, and analysis of electronic evidence, is facing new challenges and opportunities in the era of AI. The rapid proliferation of digital devices and the sophistication of cyber threats demand enhanced methods for accurate and timely evidence gathering. AI technologies, including machine learning, natural language processing, and deep learning, are empowering forensic professionals to detect, analyze, and interpret vast volumes of data with unprecedented efficiency. This chapter discusses the fundamentals of digital forensics, examines the integration of AI tools within forensic processes, and addresses the ethical and privacy concerns that arise. The insights provided will help readers understand how AI can bolster digital forensics, enabling more proactive and precise responses to cybercrime.

Although computer makes human activities faster and easier, innovating and creating new forms of work and other kinds of activities, it also influenced the criminal activity. The development of information technology directly affects the development of computer forensics without which, it can not even imagine the discovering and proving the computer offences and apprehending the perpetrator. Information technology and computer forensic allows us to detect and prove the crimes committed by computer and capture the perpetrators. Computer forensics is a type of forensics which can be defined as a process of collecting, preserving, analyzing and presenting digital evidence in court proceedings. Bearing in mind, that combat against crime, in which computers appear as an asset or object of the offense, requires knowledge of digital evidence as well as specific rules and procedures, the author in this article specifically addresses the issues of digital evidence, forensic (computer) investigation, specific rules and procedures for detecting, fixing and collecting digital evidence and use of this type of evidence in criminal proceedings. The author also delas with international standards regarding digital evidence and cyber-space investigation.

Collection and analysis of digital evidence in criminal proceedings entails risks, such as the contamination of evidence during seizure and/or search of a computer system and the inability to establish its authenticity, which may affect its admissibility and credibility before the courts. For that purpose the requirement on digital evidence preservation is prescribed in the criminal procedure law, which should apply by default to all relevant actors. Analysis of available court decisions and rules of the Criminal Procedure Act confirms that the claims concerning mishandling and/or manipulation of digital evidence do not affect ex lege inadmissibility of such evidence. Such claims would be subject to examination on the credibility (reliability) of evidence before the courts. Any detailed technical procedures and measures to be implemented so as to ensure digital evidence preservation are best suited for regulation by standard operative procedures or perhaps even by sub-legal acts. To that effect, the standard operative procedures discussed in this paper have a proven ability to ensure the common goal of ensuring digital evidence preservation. Adherence to best practices stemming from standardized procedures has shown to be vital for ensuring that investigatory procedures and acquired digital evidence are valid and as such accepted throughout the criminal proceedings.

In the last decade, digital evidence in criminal proceedings has become a key tool in modern forensic investigation, with the help of which it is possible to identify, analyze and verify information that can be crucial for making a decision in court proceedings. Digital data, through the perception of various forms of electronic records, are increasingly becoming the basic evidence in criminal cases, and because of this, no distinction is made between existing material evidence and modern digital evidence. In this research, the importance of digital evidence, its advantages and challenges in collection and processing, as well as the legal and ethical aspects of its use in criminal proceedings were pointed out and indicated. The importance of the methodological approach in the forensic analysis of digital evidence was also pointed out, all in order to achieve the admissibility of digital evidence before a criminal court. The challenges and opportunities presented by this evidence are drawn throughout the research and pointed out. The hypothesis of this research is contained in its title and refers precisely to controversial issues and the legislative application of digital evidence in criminal proceedings. The aim of the work is to consider this topic by looking at the new regulation and directive that have been passed and will only be adopted in 2026, but in principle to consider the issue of digital evidence through practice because this topic remains crucial for the further development of the judicial system in the digital age. During the writing of this research, an analytical method was used in order to consider the legislation of the European Union, and make a comparison with the domestic legislation. Then, the normative method was used when considering the criminal procedure and defining digital evidence, and certainly the deductive method was also used.

Research on the use of digital forensic evidence in the process of investigating criminal acts, especially those carried out by the Police with their legal structure capabilities, aims to find out and analyze the extent to which evidence produced through digital forensics plays an important role in the process of proving criminal acts, the results of which become electronic evidence that has the strength of evidence in the applicable criminal procedural law. The type of research is normative (doctrinal), namely research that views law as building a system of norms. Digital forensics is an important instrument that helps investigators carry out research and investigation tasks, and it is an absolute requirement that must be met so that electronic documents can be used as evidence from the start of investigations, inquiries, prosecutions, and trials. The role of digital forensics in uncovering a criminal case starts from the preliminary stage, where investigators begin to collect evidence and electronic evidence assisted by one or more digital forensic experts. Digital forensics from the investigation stage is used to find material truth in every process of proving a criminal act.

The article is devoted to consideration of modern problems of determining the admissibility of digital (electronic) evidence in criminal proceedings. Given the importance of the outlined issues, the main purpose of the study is to characterize each component of the admissibility of such evidence, namely: the proper source of receipt, the proper subject, and the proper method of collection. It is emphasized that the biggest doctrinal problem that creates an obstacle in the definition of such criteria is the lack of a unified scientific vision regarding the concept of digital (electronic) evidence and the definition of its source. The existence of three scientific approaches to the solution of this problem was established, taking into account the author's position on possible ways of its elimination. Some practical aspects related to the problems of compliance with the criteria of admissibility of digital (electronic) evidence during the investigation of criminal offenses are disclosed. On the basis of a systematic analysis of scientific work and judicial practice, it was determined that the difficulty of solving problematic aspects of the admissibility of digital (electronic) evidence is related to their complex technical nature. This is due to the fact that digital (electronic) evidence contains abstract technical and mathematical models, characterized by specific conditions of origin, existence, copying and storage, which significantly differ from other types of evidentiary information. It has been proven that when determining digital (electronic) evidence, such a mandatory feature as relevance to a certain criminal proceeding should be displayed. This is explained by the fact that in a criminal trial, digital (electronic) evidence can only be the information that is of direct importance for a certain criminal proceeding. Another mandatory component of the definition of “digital (electronic) evidence” should be an indication of its specific nature. At the same time, it is inappropriate to recognize the approach when the definitions simultaneously indicate the electronic nature of such information and its concentration on a certain electronic medium. Information that is on a certain electronic medium is electronic and not any other. Otherwise, it leads to duplication and is a logical fallacy. It is suggested that the source of digital (electronic) evidence be considered a digital (electronic) object by means of which this evidentiary information was created, recorded or transmitted. The lack of official definition of digital (electronic) evidence and their sources, in contrast to civil and administrative procedural legislation, is among the shortcomings of the current criminal procedural legislation of Ukraine. However, the definitions proposed by the legislator contain shortcomings, in particular, the fixed definitions of digital (electronic) evidence contain an unjustified opposition of related concepts, such as “information”, “data” and “facts”.

Introduction: the article analyzes the essence and innovative significance of digital evidence in criminal proceedings, discusses the procedural ways of collecting evidence that contains digital information during preliminary investigation and in court proceedings, justifies the need to modernize evidence-collecting activity. Purpose: based on the analysis of scientific sources and materials of investigative and judicial practice, to shape the understanding of a new regime of evidence-collecting activity in criminal proceedings resulting from the introduction of updated procedural methods for the collection of evidence containing digital information. Methods: general scientific dialectical method, universal scientific methods (analysis and synthesis, induction and deduction, structural-functional method, formal-logical method), special legal methods (comparative legal method, method of system interpretation). Results: we analyzed the judicial and investigative practice of applying and scientific commenting on the norms of the Criminal Procedure Code of the Russian Federation and other domestic procedural codes regulating the performance of procedural actions on the collection of evidence containing digital information. The analysis showed the need to improve the conceptual apparatus in the light of the digitalization of criminal justice procedure; revealed polarization of the legislator’s approaches to the turnover of evidence in various forms of legal proceedings. Following the analysis results, we propose unified standards of electronic evidence-collecting tools in Russian procedural legislation and the practice of their application. Conclusions: it is proposed to understand ‘digital evidence’ as both information in digital form and an electronic method of recording and storing digital data; to ensure an updated systematization of procedural actions on the collection of evidence having a digital component in pre-trial and trial proceedings; to expand the range of electronic tools of preliminary investigation and judicial review in criminal cases.