Rather they look for evidence in a computer that tells them what is in the encrypted file. Frequently, this evidence has been erased but unencrypted traces remain to make a case. For data concealed within other files or buried inside the 1s and 0s of a picture, an investigator can tell the data is there even though it is inaccessible. Nearly identical files can be compared to see their minute differences. When forensic examiners find computer evidence, they must present it in a logical, compelling and persuasive manner that a jury will understand and a defense counsel cannot rebut.
Case presentation requires experience, which only can be gained through courtroom appearances.
This is why lawyers and managers should retain computer forensics examiners who have a record of successful expert testimony on computer evidence. An experienced examiner knows the questions that opposing attorneys will ask and the ways to provide answers that withstand challenge. A skilled litigator can defeat an inexperienced examiner for failing to collect evidence in a proper manner and failing to show that evidence supports allegations. Not long ago, attorneys knew little about computers and how they operated, but today they do and they are increasingly skilled at challenging examiners' methods. A growing service With the growth of computers and networks comes growth of crime committed through or with computers and networks.