Digital forensics

Digital forensics is a specialized investigative technique that goes beyond mere data recovery technology; to uncover the substance of a case, it analyzes digital data according to a logical flow and constructs it into legally valid evidence.

It extracts data from a variety of electronic devices, such as computers, smartphones, servers, and the cloud, analyzes the content, and reconstructs it into a form that can be utilized in legal disputes or investigative proceedings.

Such work cannot be completed by technology alone. The process of grasping the essence of a case, extracting the key issues, and constructing them according to legal logic demands a high level of legal practice capability. Digital forensics can exercise its true effect only when scientific technology and legal knowledge are integrated.

Digital forensics is used as an essential tool for securing key evidence across a variety of case types. In particular, in modern society where digital devices have become a part of daily life, traces of crime often exist within digital records, and its importance comes to the fore in cases such as the following.

We introduce actual cases handled by the Digital Forensics Center.

Case 1. A case assisting a stalking complaint through recovery of iPhone messenger data

The client wished to file a complaint on charges of stalking, having suffered persistent obsession and harassment from a person met online.

However, the messenger conversation history that would be the key evidence in the case had been deleted, and the other party had instead filed a counter-complaint against the client on fraud charges.

In response, Daeryun Law Firm, through iPhone forensics, recovered approximately 20,000 KakaoTalk messages and 40 game-app messages—four months of conversations in total—and through this was able to prove the circumstances of stalking and that there had been no intentional romantic relationship.

The recovered evidence was adopted in the police investigation and, together with a medical certificate and settlement records, proved even the fact of the client's psychological harm.

As a result, digital forensics became a key tool in revealing the truth of the case and played an important role both in the application of the Act on Punishment of Crime of Stalking and in defending against the counter-complaint.

Case 2. A case assisting a response to an internal audit through mobile phone forensics

The client, suspected by the company of having received money and valuables from a partner company, became subject to an internal audit and, to prove their innocence, requested mobile phone forensics.

The Daeryun Law Firm Digital Forensics Center analyzed the entirety of the client's work and personal devices, precisely recovered deleted messages, call logs, emails, document files, and location information, selected the evidence directly related to the case, and prepared a systematic report.

In particular, through analysis of GPS data showing that the client was not at the suspected location at the time of the incident, verification of document-file metadata, and analysis of automatically recorded call files, it secured key evidence with which to respond to the internal audit and succeeded in proving the client's innocence.

Evidence secured through digital forensics is meaningful only if its legal effect is recognized by investigative agencies or the court.

To this end, attention must be paid to the following matters.

▶Compliance with lawful collection procedures

If lawful procedures are not observed in the course of collecting evidence, it may instead be deemed unlawfully collected evidence and excluded in court.

▶Caution regarding violation of the Personal Information Protection Act

Recovering or analyzing another person's device or data without authorization may become subject to criminal punishment for violation of the Personal Information Protection Act.

▶Insufficient reliability of analysis results from non-specialist firms

Forensics performed by a firm lacking an understanding of legal logic may be difficult to have recognized as evidence in court, or may instead operate to one's disadvantage.

In situations requiring digital forensics, effective evidence collection and case response are possible through the following procedures.

▶Prior consultation and device check

-A prior consultation is conducted to confirm the characteristics of the case and the feasibility of securing evidence.
-Where a password is set, the feasibility of unlocking is also examined on a device-by-device basis.

▶Setting the scope of analysis

-A strategy is established as to which data is to be extracted and analyzed, and in what manner.
-If necessary, a tailored analysis plan is established according to the type of case.

▶Data extraction and duplication

-An image is extracted without damaging the original, and analysis is conducted on the duplicate.
-This is an essential procedure to secure legal reliability as evidence.

▶Evidence analysis and report preparation

-Data analysis suited to the case is carried out so as to be able to construct the flow of circumstances.
-A digital forensics report for submission to the court is prepared, to be utilized in subsequent trial and investigative proceedings.

▶Supplementation of additional evidence and legal response

-The system is designed so that, where additional analysis is required as the case progresses, an immediate response can be made.

Digital forensics is not merely a technical service but a strategic tool for resolving legal cases.

Accordingly, digital forensics must be approached within the context of ‘legal practice,’ and in this respect our firm’s Digital Forensics Center offers the following points of distinction.

We invite you to experience the genuine value of digital forensics—not the digital forensics that other providers merely imitate, but the kind that discovers evidence, designs strategy, and changes the course of a trial.