Hiding assets, having an affair, committing adultery are among some of the common grounds for in divorce cases in the UK. These actions could be relevant in child custody proceedings as well. Crucial information such as Facebook, Tinder, Instagram, Snapchat, WhatsApp messages, deleted emails, text messages, documents, photos and files can be recovered or analysed together with internet search history and combined with file creation dates and timestamps of files as well as content in the text of messages and email conversations to provide insight into the character and behaviour of the spouse and supply critical information for the petitioner or respondent’s divorce case.
The first thing to be be done, is acquiring a forensic image of all hard drives, mobile phones and tablets of the suspected spouse. Securing a forensic image early in a divorce case may make the difference between winning and losing. The forensic method to obtain an exact image from a computer and mobile phone, will be a bit by bit copy without a loss of data and will have to made write-protected right after imaging to preserve the integrity of the evidence and to ensure it chain of custody.
Forensic investigators need not view the contents of a hard drive when creating an image, so legal arguments of relevance, privilege, confidentiality, and admissibility can be left until the actual investigation is authorised and conducted on the forensic images acquired.
It is important that the spouse instructs a computer forensics examiner to acquire full images of the computers and mobile phone of the subject in the early stages so that any spoiling of digital evidence is avoided and critical information is not deleted or lost. Later a forensic expert can proceed with an investigation to collect and document all the digital evidence for the solicitor so that this can be used in court. When children and custody are involved, having a computer forensic investigator perform a complete analysis of the the acquired digital evidence to prove or disprove certain suspicions is critical. Computer forensics investigations go far beyond basic looking around in a computer or mobile phone by a non-expert.
An IT person, computer savvy friend or the local computer shop CANNOT be considered and trusted with imaging, collecting and/or analysing computer and mobile evidence. Quite often they do not have the skills or the tools to find the evidence and they may even compromise or damage crucial digital evidence by not following the correct procedure. In addition to this, courts will not recognise their findings if they do not have certifications or have not been suitably trained to conduct computer forensics investigations on a computer or mobile phone.