Digital evidence is defined as information and data that is stored on, received or transmitted by an electronic device and used as evidence in legal proceedings. Information that is stored electronically is said to be “digital” because it has been broken down into digits; binary units of ones (1) and zeros (0).
The data exists when an electronic device is used by any person to do his works, to access other person’s device or to communicate with others. This data is kept in the hard drives of the electronic device system and available in different software programs. It will remain in the device until it is removed, deleted or rewritten.
This data is used as evidence in a variety of cases including cases of computer misuses, conspiracy, murder, rape, breach of online contracts, internet defamation and many others. When a device is seized and secured for examination, the data will then be retrieved, analysed and used as evidence to prosecute and charge the suspects.
The pre-crime and post-crime data or information is most relevant, for example where:-
- A criminal was using an online program like Google Maps or street view to case a property before a crime;
- A criminal posting stolen items for sale online like ebay; or
- A criminal communicating via text message with accomplices to plan a crime or threaten a person.
Computer generated evidence under the Evidence Act 1950
When we talk about sources for digital evidence, most people immediately think of computers, cell phones and the Internet which are everywhere in today’s world, helping people communicate locally and globally with ease.
According to Section 3 of the Malaysian Evidence Act 1950 ‘computer’ means, any device for recording, storing, processing, retrieving or producing any information or other matter, or for performing any one or more of those functions, by whatever name or description such device is called.
Meanwhile, Section 2(1) of the Computer Crimes Act 1997 defines the term ‘computer’ as, an electronic, magnetic, optical, electrochemical, or other data processing device, or a group of such interconnected or related devices, performing logical, arithmetic, storage and display functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device or group of such interconnected or related devices, but does not include an automated typewriter or typesetter, or a portable hand held calculator or other similar device which is non-programmable or which does not contain any data storage facility.
Section 90A of the Evidence Act 1950 governs on digital evidence and its admissibility. According to the provision, document produced by a computer shall be admissible as evidence if the document was produced by the computer in the course of its ordinary use. It may be proved that a document was produced by a computer in the course of its ordinary use by tendering to the court a certificate signed by a person who is responsible for the management of the operation of that computer.
Once the certificate is produced, there is a presumption under Section 90A(4) that the computer referred to in the certificate was in good working order and was operating properly in all respects throughout the material part of the period during which the document was produced
In summary, digital evidence is admissible as primary evidence as long as it is relevant, reliable and authentic. It is considered as one of the exceptions to hearsay rule that does not require direct oral evidence from a witness. Thus, the most important elements that need to be fulfilled are the printout from the computer should be produced in the course of its ordinary use and the person who makes or tenders
the document is the person responsible to that output.