Electronic Law and Evidence Overview

A court order authorizing the interception of wire, oral, or electronic communications. It's required when real-time communication content is intercepted using a device without consent.

A legal document that allows law enforcement to request an ISP (Internet Service Provider) to preserve electronic data for up to 90 days to prevent its deletion.

When law enforcement uses physical intrusion with the intent to obtain information, it's considered a search under the Fourth Amendment.

The Fourth Amendment protects individuals' reasonable expectation of privacy against government intrusion. It applies to both physical and non-physical intrusions.

This doctrine establishes that individuals have a reasonable expectation of privacy in their movement data when tracked for extended periods. This means tracking someone for more than 7 days requires a search warrant.

A legal requirement for obtaining a Title III wiretap. Investigators must provide a detailed explanation of prior investigative steps taken, why those steps were unsuccessful, and why the wiretap is necessary.

Computers can be searched or seized without a warrant if there's probable cause to believe they contain evidence of a crime, and it's in danger of being destroyed or removed.

External factors that can damage electronic evidence, such as magnets, high temperatures, and water.

Internal factors that can damage electronic evidence, such as overwriting data.

Traditional forensic techniques that focus on physical evidence related to electronic crimes, such as fingerprints, DNA samples, and trace evidence.

A digital currency that uses cryptography for security and operates independently of central banks. It's not physical and exists as a record on a distributed ledger.

A list of 12 to 24 words that act like a key to access and manage Bitcoin accounts or cryptocurrency wallets. If lost, the account's access is irretrievable.

The process of converting traditional currency (like USD) into cryptocurrency or vice versa. It's how you enter and exit the world of digital assets.

The process of documenting the chain of custody for evidence, including who handled it, when, and where.

A process where a witness's testimony is supported by evidence and documentation, demonstrating the connection between the evidence and the case.

A legal concept where a person can give permission for something, like a search, with limitations. These limitations can be specific, like not looking in emails, or more general, like only allowing search by someone with authority.

Circumstances that create a dire need for immediate action, usually overriding the need for a warrant. This can involve a threat of destruction of evidence or an imminent danger.

The ability to seize evidence clearly visible in plain sight, but not to extend a warrant based on what's seen. You can't expand a search based on something found in plain view.

A search conducted immediately after an arrest. You can't search a phone's contents, but can remove the case and examine the phone itself.

A type of warrant specifically designed for searching and seizing digital devices like computers, phones, and network equipment.

Digital devices hold various types of data, so the warrant should list all possible devices that might contain relevant information.

When dealing with digital evidence, a warrant execution should involve specialists in the field to ensure proper handling and analysis of data.

The authentication of digital evidence involves establishing its integrity, authenticity, and reliability. Factors like the source, ownership, and access history must be determined.

A person's relationship to others that could influence their testimony or perception of events. It can be blood-related, marital, professional, or based on shared experiences that could affect objectivity.

To question a potential juror's qualifications and biases to ensure they can be impartial during the trial.

The government's presentation of evidence to support their case against the defendant, including witness testimony and physical evidence.

The opportunity for the defense to present their own evidence to challenge the government's case, including calling witnesses and presenting evidence.

A type of legal argument made by one side after the other side has rested its case, to challenge the evidence presented and persuasively argue their side.

A detailed book that lists controlled substance information, including active ingredients, colors, shapes, dosages, and legal classification.

A physical substance found at a crime scene that can help investigators identify the perpetrator or understand what happened.

The proper techniques for locating, documenting, collecting, and packaging evidence to ensure its preservation and admissibility in court.

Handwriting samples obtained under controlled conditions, usually for comparison purposes.

Handwriting samples collected without the subject's knowledge or consent, often found in everyday materials.

A formal document accompanying the evidence submission to a lab for analysis, outlining case details, requested analysis, and contact information.

A state of severe emotional distress or dysfunction that significantly affects a person's ability to function.

Techniques used to calm and de-escalate situations involving individuals experiencing a mental health crisis.

Observable behaviors and physical indicators that suggest a mental health crisis.

Subjective experiences, feelings, and internal perceptions reported by individuals experiencing a mental health crisis.

Physical evidence is anything tangible that can be used to prove or disprove a fact or theory. It includes visible items like blood or a gun, as well as invisible items like DNA. Physical evidence cannot be impeached, meaning it cannot be discredited or challenged by testimony.

Class characteristics are qualities shared by all items of a certain group. For example, a screwdriver is a class characteristic because it falls within the general category of screwdrivers. This means that a screwdriver found at a crime scene does not definitively link it to a specific person.

Individual characteristics are unique features that can link an item to a specific source. For example, a screwdriver with a bent handle is an individual characteristic, as it sets it apart from other screwdrivers. Individual characteristics can be used to identify the specific object or person involved in a crime.

Locard's exchange principle states that every contact leaves a trace. This means that when two objects come into contact, a transfer of material occurs. This material can be used to link a person or object to a crime scene, and it helps explain why trace evidence, like fibers or hair, is often found at crime scenes.

The age of a document can be determined through ink and paper analysis. The US Secret Service maintains a large ink library, which can be used to identify the ink used on a document. Paper often contains watermarks that can also help date the document.

Handwriting can be identified through a number of methods, including comparing the writing to known samples and analyzing handwriting characteristics. It is important to obtain a variety of writing samples from the suspect in order to get a reliable comparison. Some of the features that can be analyzed include letter formation, slant, spacing, and pressure.

Laser printers often leave marks on paper from improper maintenance, and these markings can help trace the printer to its source. Glass copiers typically leave trash marks, which are small imperfections on the copies, that can aid in identifying the copier. Some large copier companies imprint each copy with a matrix of identifying dots that can be used to trace the copy back to its origin.

In order to properly document a crime scene, you should create thorough photographs, sketches, and notes. Sketches should include a north arrow, a note stating “Not to Scale” and a key or title block which should include the case number, date and time, as well as who, what, where, when and why. There are three methods for measuring items for inclusion on a crime scene sketch: Baseline, Rectangular,  and Triangulation. Triangulation is the most accurate method.