Digital Forensics and Digital Evidence Law

Legal assessment of forensic reports, technical records and electronic evidence: provenance, reliability, attribution and their role in proceedings in Türkiye.

Digital evidence can include messages, device records, server logs and electronic documents. A record appearing on a screen is not necessarily an authenticated, complete and attributable account of an event. Challenging a forensic report requires identifying the particular finding, underlying data and method that need explanation.

Our work includes case-file review, legal assessment of digital reports, formulation of technical questions and preparation of evidence requests. Where specialist scientific analysis is required, legal work and an independent forensic examination have distinct, complementary roles.

1. Digital forensics, reports and evidence

Three related but different concepts

Digital forensics concerns the acquisition and examination of electronic data through accepted methods. A forensic report should explain its scope, method, findings and limitations. Digital evidence is the electronic information whose connection to the dispute is being assessed. Software output alone does not replace a reasoned expert explanation.

Emails, session records, phone data, electronic documents and video recordings can raise different questions. Those questions should be defined before a large volume of material is presented as though its quantity alone established its value.

2. Provenance, integrity and chain of custody

The origin of a record and the handling of the data should be traceable. Collection, copying, transfers and examination need an intelligible documentary record. Any missing step must be assessed for its actual effect rather than treated through a blanket assumption.

• Source: the device, account, server or recording medium concerned.
• Handling: documented receipt, copying, examination and transfers.
• Integrity: appropriate hash checks identifying what was checked and when.
• Method: the tools, versions, scope and limitations of the examination.
• Reviewability: findings and underlying records presented in a form that permits scrutiny.

A matching hash can help establish data integrity. It does not, by itself, identify the author of a file or establish criminal intent. Integrity and the legal elements of an allegation are separate questions.

3. IP, CGNAT, timestamps and attribution

Subscriber, account holder and actual user

An internet subscription does not automatically establish who performed a particular act. Shared access, changing connections, sessions and device access require assessment against the actual records. A possibility is not a finding; it must be investigated where relevant.

UTC and local time

Platform, device and operator records may express time differently. Meaningful comparison requires identifying the time zone and the event each timestamp represents. A creation time, access time and reported transmission time should not be treated as interchangeable.

Our articles on social media, IP and CGNAT (Turkish) and UTC and timestamps (Turkish) explore these issues further.

4. Phones, computers, messages and applications

The data available from a mobile device depends on factors including the device state, operating system, application version and acquisition method. Reports should explain what could and could not be recovered. The meaning of a technical data field must be distinguished from the way an application displays information.

WhatsApp or Telegram conversations, emails, screenshots and social-media records should be assessed in context, including completeness, origin, authentication and lawful acquisition. A selected screenshot may leave important questions about the surrounding conversation unanswered.

Cache files and automatic application records require particular care. The presence of a file does not, without further examination, explain whether a user deliberately opened, saved or shared it. An assertion of automatic recording also needs testing against the available findings. See our NCMEC and CRC Reports practice area for related notification-based cases.

5. Challenging expert reports and obtaining scientific opinions

A focused challenge identifies the unanswered question and its importance to the case. Missing underlying data, unexplained methods and inconsistent time records may call for different requests: clarification, supplementary examination, a further report or an independent scientific opinion.

• Does the conclusion answer the question referred for examination?
• Are assumptions distinguished from observations and supported inferences?
• Is the basis for linking the event to an account or device explained?
• Are exculpatory findings and relevant alternative explanations addressed?
• Are limitations and unresolved questions clearly stated?

Article 67 of the Turkish Code of Criminal Procedure provides for obtaining a scientific opinion from an expert. Technical expertise can clarify the evidence; legal classification and the ultimate judicial assessment remain matters for the competent authority.

6. Cybercrime and disputes involving electronic records

Allegations concerning unauthorised access, interference with data or systems, online fraud and account use can involve different technical and legal issues. The existence of a transaction or activity record must be distinguished from proof that it establishes the alleged conduct.

Case preparation seeks to reconstruct events, identify the legal questions and define any necessary scientific examination. The volume of digital data does not determine its evidential weight.

Case review and appointments

Reports, procedural records and documents you may lawfully access help define the initial review. Do not obtain evidence by accessing someone else’s account without permission or redistributing unlawful content. An appropriate method of document review and transfer should be agreed when arranging an appointment.

Appointments and contactAll practice areas