Project Description

The determination of the authenticity of individual medieval records of questionable provenance was the original reason for the development, in the 17th century, of the science of Diplomatics, and, in the context of Archival Diplomatics, its theory and methods have been successfully applied to contemporary records in digital form. Thus, in several ways, the object of study of Computer Forensics and Archival Diplomatics overlaps and their methods of inquiry complement each other. At the same time, their perspectives are very different and the sum of their bodies of knowledge is not at this time able to address all the issues of recordness and authenticity with which our legal system is constantly confronted, due to the extremely rapid obsolescence of information technologies and to the manipulability, mutability and fragility of the digital entities that these technologies produce and store, especially after those entities have been removed from the original system. The purpose of this research program is to develop a new branch of archival studies, called "Digital Records Forensics," by integrating the concepts and methods of Archival Diplomatics, Computer Forensics and the Law of Evidence (the rules and procedures that govern proof at a legal proceeding). This integration will: 1) enable those who need to assess the trust-worthiness of digital records that no longer reside in the original system in which they were made or received and maintained to ascertain whether they are accurate and authentic, having preserved their original identity and integrity; 2) foster development of methods for maintaining the authenticity of these records over the long term, regardless of their format; and 3) ensure that the Law of Evidence maintains an awareness of the changing nature of documentary evidence determined by digital technologies and adjusts its requirements and procedures to the changing characteristics of such evidence.

The legal systems, both common and civil law, consider records to be a very special kind of documentary evidence. Records are defined in archival science as any document made or received in the course of a practical activity and kept for action or reference. In civil law environments, a record is admissible as evidence in court simply on the basis of the recognition of its record nature. In common law environments, disputed records may require further steps to gain admissibility: such as proof of authenticity, and compliance with the best evidence rule and with the hearsay rule. Thus, it is vital to establish clear and stable parameters for the identification of records among all the digital entities that may exist in a digital system, be it a document management system, a geographic information system, an assembly of separate applications, like e-mail, or any other form of information technology.

At common law, to be admissible, records must constitute the “best evidence.” The best evidence rule requires that the original of any document, regardless of medium or form (e.g., a letter, a recording), be used as evidence at trial. A copy will be allowed into evidence only if the original is unavailable for a legitimate reason. However, in the digital environment, we no longer have originals, because the first record, when saved within the system, separates in its digital components, which, when the record is retrieved, are reassembled to form a copy. In fact, we cannot keep digital records. We can only maintain our ability to reproduce or even to re-create them as needed. As a consequence, the authenticity of digital records is difficult to establish on the records themselves and becomes an inference that one draws regarding the integrity of the system (Electronic Transactions Act (B.C.), s. 8, 2001; Canada Evidence Act, s. 31.2(1), 1985).

Nevertheless, the law requires that an authentication of the record submitted as evidence be made by a competent third party who either recognizes the record, if it is an original, having seen it before, or provides an expert opinion on its authenticity. Traditionally, archivists have been able to provide the needed expertise, but their body of knowledge is inadequate to assess the authenticity of digital records and will profit from an understanding of the methods Computer Forensics uses to analyze and evaluate the environment in which the records existed. In turn, Computer Forensics methods will not only benefit from, but be extraordinarily enriched by Archival Diplomatics, which has established very sophisticated methods for assessing record trustworthiness and developed a strong conceptual model of an authentic record rooted in jurisprudence, administrative history and theory, and on recordkeeping practices in bureaucratic organizations. This model is especially important for answering questions about the authenticity of digital records extracted from their original environment and about procedures for extracting records so that their identity and integrity can be maintained intact, thus allowing them to be later authenticated.

The recommendations and guidelines issued by the InterPARES Project (www.interpares.org) ensure that it will be possible to preserve authentic copies of these records permanently. The problem that still needs to be addressed, using the knowledge of digital records trustworthiness developed by the InterPARES Project and the new concepts and methods of Archival Diplomatics derived from it, is that presented by records that have been extracted from the system in which they were generated and/or maintained either by the creating body itself or by third parties, such as police departments or archival organizations or units. These records may have been removed from the original system and placed on portable media by the creator for storage elsewhere, or by other parties, such as law enforcement officers, for use as evidence in criminal investigations. Thus, they may end up on CDs or DVDs accumulated in an office drawer, or on backup tapes in an off-site warehouse. They may also end up being acquired at auctions, either inadvertently, for example by individuals who, after buying what they assumed were blank, used tapes, later discover that they actually contain records, or intentionally, for example by collectors of digital art, unaware of the difficulty of assessing the authenticity of such art when separated from its original technological context. These records are often of uncertain origin and/or exist in proprietary formats that are hard to maintain over time, yet often must be maintained intact with their identity and integrity for long periods of time (e.g., while waiting to serve as documentary evidence in a trial, or for their ongoing research value).