Competing narratives: A comparative case study of prosecutors’ and defence lawyers’ interpretations of digital evidence

Abstract

Digital evidence increasingly shapes charging decisions and judicial outcomes, yet its technical complexity raises concerns for equality of arms. This paper presents a comparative case study replicating a previous analysis of prosecutors with practising defence lawyers. Using identical materials and scenarios, it examines how role, access to information, and institutional assumptions shape evidentiary assessment. We compare prosecutors’ and defence lawyers’ judgements on the relevance, evidential weight, and verification needs of four types of digital evidence. Prosecutors in the original study accepted police-reported evidence at face value, integrating it into a coherent narrative of guilt. Defence lawyers likewise acknowledged its potential significance but adopted a verification-led stance, granting high weight only with access to raw data, provenance checks, synchronisation, and independent expertise. The findings raise concerns under Article 6 of the ECHR, highlighting systemic imbalances. We recommend reforms, including clearer reporting, early disclosure, institutionalised quality assurance of digital evidence, enhanced training, and expert support.

Introduction

Digital evidence now sits at the core of criminal adjudication, yet its technical opacity strains fair-trial guarantees under the European Convention on Human Rights (ECHR) Article 6, particularly equality of arms and the defence's capacity to scrutinise methods and provenance. Defence lawyers are tasked with rigorously testing the prosecution's case, including digital forensic reports prepared by police experts. However, their ability to do so is shaped by multiple intersecting constraints: evolving legal frameworks, uneven disclosure and limited access to underlying data, restricted time and resources, and the inherent complexity of contemporary tools, datasets, and workflows. These conditions can blunt adversarial challenge by making it difficult to assess how digital evidence was generated, validated, and interpreted, including its methodological foundations, uncertainty, and chain of custody. Where scrutiny is curtailed, evidential weight may be influenced less by demonstrable reliability than by narrative coherence, rhetorical persuasiveness, or the authority of technical discourse, thereby introducing potential bias in how such evidence is evaluated. Clarifying how such constraints affect defence evaluation of digital traces is therefore essential to understanding decision-making under uncertainty and to identifying procedural safeguards. These include timely disclosure of raw data, transparent documentation of forensic methods, clear reporting of provenance and limitations, and access to independent expertise – all of which are necessary to uphold meaningful equality of arms.

This paper investigates how Norwegian defence lawyers engage with digital forensic reporting and the constraints that shape their ability to critically evaluate digital evidence. We examine the following research question: What factors influence defence lawyers' ability to scrutinise digital evidence presented by digital forensic examiners, and what are the implications for quality assurance and legal safeguards?

While existing research largely centres on digital forensic practices, there is limited empirical insight into how legal decision-makers, particularly prosecutors and defence lawyers, understand, interpret, and assess the relevance and reliability of digital evidence. The study contributes novel insights by examining how defence lawyers in Norway evaluate such evidence, thus offering new knowledge about the legal interpretation of digital traces and the procedural conditions necessary for effective scrutiny.

Background and related work

Defence lawyers' role in the Norwegian legal system

To contextualise the findings and clarify the roles of legal actors in this study, it is useful to outline the core features of the Norwegian legal system, particularly as they pertain to the division of responsibilities between prosecution and defence. In Norway, the prosecution carries the burden of proof and is responsible for investigating criminal cases, including an obligation to pursue evidence regardless of whether it is incriminating or exculpatory, reflecting an objectivity requirement rather than purely adversarial case-building. Prosecutors are responsible for substantiating charges beyond a reasonable doubt, which entails not only presenting inculpatory evidence but also actively considering exculpatory information. Their role is anchored in a fact-finding ethos rather than adversarial competition, requiring an impartial evaluation of the evidence base. The prosecution is tasked with assembling a case while ensuring that the process remains fair and balanced. In practice, this standard positions prosecutors as safeguards of procedural integrity, with a legal and ethical obligation to treat evidence not as a tool for conviction, but as a basis for truth-seeking.

While the judge remains impartial, the court has a duty to ensure that the case is sufficiently investigated before judgment, which situates fact-finding largely within an investigation-led model. Defence lawyers safeguard the legal rights of the accused throughout the criminal process. They provide legal advice, represent the accused during police questioning, attend court hearings, and may appeal decisions. A central duty is to ensure that the principles of due process, particularly under Article 6 of the European Convention on Human Rights, are respected. As a statutory baseline, a person charged is entitled to the assistance of defence counsel at every stage of the proceedings. In practice, this is reinforced through mandatory public appointment in custody-related situations: if a suspect is arrested and it becomes clear that he or she will not be released within 24 h of arrest, or within 12 h if the person is under 18 years of age, defence counsel must be appointed without undue delay. As a result, defence lawyers do not lead the investigation but must be vigilant in assessing the legality and fairness of the prosecution's case and the evidence presented. They may request investigative actions and participate in hearings to contest detention or challenge unlawfully obtained evidence. Norwegian reform work emphasises that much of criminal procedure is extrajudicial and that the Criminal Procedure Act is largely an investigation act, a structural feature that helps explain why defence interventions may be more constrained early and become most visible through targeted challenges and evidential contestation at later stages (NOU, 2016: 24).

Unlike in the UK or US, Norwegian defence lawyers do not rely on adversarial confrontation to the same extent, and although there are lay judges, there is no jury. Nevertheless, the defence is expected to present arguments, examine witnesses, and offer counter-evidence during trial. Public legal aid (Norwegian: fri rettshjelp) is available for many defendants in Norway, and courts appoint a defence lawyer in serious cases. While the role of the Norwegian defence lawyer is generally more collaborative with the court and less combative than in common law systems, it remains essential to safeguarding the presumption of innocence and the right to an effective defence.

Research on defence lawyers and digital evidence

Research increasingly demonstrates that digital evidence, while often perceived as objective and reliable, may contain significant flaws or inaccuracies stemming from methodological, human, or systemic sources (Stoykova et al., 2022; Sunde and Dror, 2019, 2021). Despite high levels of digitalisation, persistent competence gaps remain within Norwegian law enforcement (Heitmann and Franke, 2023), and recent studies highlight that robust internal quality control mechanisms are still not consistently implemented (Bauge, 2023; Bauge et al., 2025; Jahren, 2020; Sunde and Dahl, 2025). These findings underscore the essential role of legal decision-makers, not merely as passive recipients of forensic outputs, but as active evaluators interrogating the provenance, interpretation, and limitations of digital evidence. However, recent research indicates that this critical evaluative function is not always realised in practice. Erlandsen (2019) found that prosecutors often demonstrated limited understanding of forensic methodology. In his scenario-based study, prosecutors consistently assigned high evidential weight to digital traces such as mobile phone activity logs, call data records, CCTV footage, and GPS data, even when those items exhibited methodological flaws or lacked necessary contextual information.

Despite these contributions, a salient gap remains: the role of defence lawyers in evaluating and challenging digital evidence is examined only to a limited extent. Two recent studies highlight structural barriers to effective challenge. In England and Wales, Wilson-Kovacs et al. (2023) report routine hurdles such as delayed disclosure, inaccessible formats, overwhelming data volumes, and scarce resources for independent experts, such that limited digital literacy and institutional support can blunt adversarial testing. In Canada, Rajapakse (2024) finds misinterpretation risks linked to cognitive biases, insufficient technical training, and over-reliance on expert testimony, arguing for standardised interpretive frameworks and interdisciplinary education. Research in the United States also highlights persistent challenges for defence lawyers in engaging with digital evidence. A large-scale National Institute of Justice (NIJ) report by Goodison et al. (2015) underscores that, compared with prosecutors and investigators, defence lawyers are least equipped to understand, challenge, or contextualise digital evidence, largely due to limited training, resource constraints, and structural disadvantages in discovery processes. More recent empirical work by Braun et al. (2025) shows that many defence lawyers in Texas criminal courts fail to access digital discovery platforms at all, with patterns of non-use varying according to the seriousness of the offence, the lawyer's experience, and local court practices. Moreover, Crimmins (2021) compared US prosecutors’ and defence lawyers’ knowledge and attitudes towards digital evidence. Results showed no difference in their knowledge; however, prosecutors had a more favourable opinion of digital evidence compared to defence lawyers. In terms of structural challenges, defence lawyers noted challenges in reviewing large amounts of data and understanding the meaning of the evidence. Prosecutors reiterated concerns about volume and emphasised additional issues relating to regulation, authentication, and attribution.

Together, these studies suggest that the ability of the defence to scrutinise digital material is constrained by practical barriers, including lack of time, staffing, and technological support, raising concerns about fairness and the effective exercise of the right to a defence. Taken together, these contributions show that the reliability of digital evidence is inseparable from the legal system's capacity to ensure meaningful defence scrutiny. Against this backdrop, we set out to examine whether the prosecutors’ and defence lawyers’ judgements of the evidential weight of concrete digital traces were role-conditioned. Such an inquiry is crucial because defence lawyers play a central role in making the court aware of potential weaknesses in the prosecution's evidence. If prosecutors have a systematic tendency to overestimate the reliability of digital traces, while at the same time lacking the ability or incentives to identify their limitations, and defence lawyers are constrained in their capacity to challenge such evidence, the result may be an imbalance that undermines the procedural safeguards designed to protect defendants. In this way, the interaction between prosecutorial assessment and defence scrutiny becomes pivotal to the integrity of the fact-finding process and, ultimately, to the safeguarding of fair trial rights.

Methodology

In terms of sample, seven practising Norwegian defence lawyers were recruited through a purposive sampling strategy (Patton, 2014). Six of these agreed to participate in the case study and interview, while one participated only in the interview. All had at least five years of professional experience in criminal defence, and they displayed diversity both in geographical distribution across the country and in the size of the firms represented. Their casework backgrounds included serious offences such as narcotics, violent crimes, and sexual offences, all of which involved extensive experience with digital evidence. The purposive design ensured that participants had direct, practice-based familiarity with digital traces in criminal proceedings, while still providing variation in geographical and professional context. The aim was not statistical representativeness but to generate rich, practice-informed insights into how defence lawyers evaluate digital evidence.

A scenario originally developed by Erlandsen (2019) was used to examine the defence lawyers' reasoning and decision-making around digital evidence. The scenario replicates a pedestrian-collision case inspired by an actual criminal case and preserves core factual contours while anonymising parties. It integrates multiple digital traces, such as mobile phone activity logs showing incoming and outgoing communication in Snapchat, call data records including cell-cite records, CCTV, and vehicle GPS data, selected for their prevalence and different levels of evidential value. All exhibits are rendered in standard police reporting formats to maximise ecological validity and ensure participants interact with documentation that mirrors routine casework. The full vignette and exhibits are provided in Erlandsen (2019, Appendix 4 and 5). Using this common stimulus enables a direct, structured comparison with Erlandsen's original prosecutor sample.

Participating defence lawyers were instructed to review the case vignette, identify the digital traces they considered relevant, rate the evidential weight of each (high/low) and briefly justify their assessments. The task was designed to approximate routine professional practice in evaluating police digital-forensic reports, capturing both selection (relevance) and evaluation (weight) decisions. The responses were subsequently counted, converted to percentages, and analysed using the same categorisation scheme employed by Erlandsen (2019). To examine their assessments and justifications further, they were interviewed after completing their assessments of the scenario.

A thematic analysis (Braun and Clarke, 2006) was performed on the interview data. This stepwise procedure ensures rigorous and transparent qualitative analysis and supports the production of analytically grounded insights relevant to informing the knowledge base on digital evidence decision-making practices.

Participants were anonymised and assigned numbers to distinguish individual voices while preserving confidentiality. In quotations, they are referred to by participant number (e.g., P1). This system enables the reader to follow the perspectives of specific individuals across the analysis without revealing any identifying information.

We note that the data collection was originally conducted as part of the first author's Master's thesis. The analysis and interpretation have since been substantially expanded and refined for the purposes of this article.

Results and analysis

The scenario, adopted from Erlandsen (2019), presents a simulated pedestrian-collision case. A woman driving her car through a small town struck a man at a pedestrian crossing, causing him injury. She immediately contacted emergency services, and the police arrived shortly thereafter to investigate the incident.

The police file contains four digital traces, all described in a police report: an excerpt of the suspect's mobile phone activity log, excerpts from call data records supplied by the telecom provider, descriptions of footage from CCTV obtained from a nearby railway station, and the results from manual analysis of the vehicle's GPS unit.

The final four minutes before the collision show several Snapchat exchanges, with the last outgoing Snap seemingly sent only ten seconds before the suspect called the emergency services. The call data records from the telecom provider confirm the outgoing call but reveal a 12-s discrepancy between the mobile phone activity log and the call data record. CCTV footage captured the incident, showing the car striking the pedestrian in the middle of the crossing without any visible attempt to brake or swerve. Vehicle GPS data recorded a speed of approximately 46 km/h in a 50 km/h zone. Taken together, these traces may appear to constitute strong evidence for negligent driving. However, although compelling, the evidential picture was incomplete. A closer examination of the phone's databases would have revealed that the Snap message that was sent 10 s before the emergency call had in fact been created and attempted to be sent earlier, but due to poor network coverage in the area, the Snap was only transmitted shortly before the collision. The conclusion that the driver was distracted by mobile phone use at the time of the accident was therefore unfounded.

In Erlandsen's study, prosecutors (n = 14) identified all four items as relevant and accorded them substantial collective weight. In our replication, defence lawyers (n = 6) were presented with the same case materials. All defence lawyers identified the same traces as relevant. Below, we report how prosecutors (from Erlandsen's dataset) and defence lawyers (from our interviews) evaluated each evidence type, and we provide a comparative analysis of their approaches to evidential weight, and verification needs.

Across the four trace types, prosecutors (Erlandsen, 2019) generally assigned high weight to the digital evidence as presented, whereas defence lawyers in our replication adopted a conditional ‘trust-but-verify’ stance (Figure 1).

Figure 1.

Comparison (in percent) of prosecutors’ (Erlandsen, 2019) and defence lawyers’ ratings of high evidential weight across the four types of digital evidence presented in the scenario.

Mobile phone activity logs

For mobile phone activity logs, all prosecutors and defence lawyers recognised this as a relevant finding. Seventy-one per cent of prosecutors versus 83% of defence rated the item as having high evidential weight, though defence repeatedly conditioned this on verification of timestamps, extraction, and user action. Prosecutors generally accorded high evidential weight to the mobile phone activity log, treating it as pivotal for establishing negligence because it could show active phone use while driving. Several argued that sending or viewing a Snap immediately before impact would strongly indicate distraction. A few raised technical queries, most commonly the 12-s skew between handset time and telecom records and its implications for app timestamps. However, these doubts seldom reduced confidence. Most assumed the extraction was correct, and one even likened its evidential weight to a blood test. Only a minority (29%) rated the log as low weight, typically because they wanted more detail on how Snapchat events were captured and parsed, and what the entries actually demonstrated (Erlandsen, 2019).

Defence lawyers likewise regarded the mobile phone activity log as central, and 83% rated its evidential weight as high. Unlike prosecutors, however, they attached explicit caveats. Most characterised the item as ‘high if verified’, stressing confirmation of extraction integrity and correct interpretation. Where prosecutors tended to assume the integrity of app logs once extracted, one defence lawyer stressed the absence of corroborating observations and highlighted uncertainties around Snapchat timestamps:

I find it a bit difficult to classify whether it is high or low, because it must be assessed in relation to other information in the case. But as the witness statement appears here, no one has seen that there has been any use of Snapchat. And she does not mention it during the actual drive either. So, based on the information we have here about possible inaccuracies in the sending time, that does not necessarily prove that there was Snapchat use at all. At least not during the critical phase of the drive. (P2)

Common checks included validating timestamps (mobile phone clock accuracy; potential time skew with call data records), clarifying whether recorded events were user-generated or automatic app activity, and considering transmission delays due to network coverage. While prosecutors saw handset records as technically precise, one defence lawyer questioned the reliability of Snapchat timestamps, underscoring potential desynchronisation between device and app timekeeping:

Well, I would think the mobile phone has relatively high evidential value. But the question is…I would somehow have thought… Can we know whether these timestamps on Snapchat are accurate? Even if the phone has the correct time, that does not necessarily mean that Snapchat has the correct time. And can we really… I might have thought… As a defence lawyer, I would have considered… Is there something… Can one rely on it? That is what I would have questioned. (P3)

Several defence lawyers questioned what the entries actually demonstrated about moment-of-impact behaviour and asked for corroboration (e.g., examining the victim's handset to confirm message exchange). One defence lawyer assigned low weight on the basis of “double uncertainty”, questioning whether the phone's clock was correct and whether the network coverage could have influenced the times for sending and receiving Snap messages. Overall, while recognising the log's potential to evidence distraction, defence evaluations were conditional and verification-led, prioritising raw-data access, provenance, and expert confirmation before attributing decisive evidential weight.

Telecom call data records

For telecom call data records, prosecutors uniformly rated their evidential weight as high (100%). In contrast, 33% of defence lawyers rated them as high, and the sceptical defence responses centred on access to raw call data records rather than police summaries of these in reports.

Prosecutors treated telecom provider call data records as reliable third-party corroboration of the handset timeline. Their primary rationale was timestamp verification: operator logs could confirm whether events recorded on the phone aligned with network activity. Several also noted that these records might reveal omissions (e.g., deleted calls or texts), thereby strengthening or, if inconsistent, weakening the overall narrative. For prosecutors, provenance mattered: data issued by a national carrier was repeatedly cited as enhancing credibility and making the evidence appear objective and hard to contest. In short, prosecutors framed call data records as an independent cross-check that would strengthen the case and be difficult for the defence to refute (Erlandsen, 2019).

Defence lawyers’ views of the telecom-provider records were divided. Some rated them as high weight because an independent source could verify handset timestamps and narrow or widen the pre-impact timeline. Others were markedly sceptical. One defence lawyer assigned low weight on the basis that the file contained only a police-authored summary of the carrier data, and that he would not rely on it in the absence of direct access to the raw call data records:

P4: I do not actually see the digital evidence here, so in reality there is no digital evidence included. So I would in fact change my answer: I do not see digital evidence here.

Interviewer: you do not see it?

P4: No, it is Police Officer 2 who reproduces this in a separate report, but I would need to see the telecom data itself. It is only that Svein Storeby has reproduced telecom data obtained from Telenor. That is not sufficient for me. I would have requested the original dataset from Telenor. (P4)

Another defence lawyer likewise rated the item low, citing a mismatch between Snapchat times on the phone and network log times, which in her view undermined any firm inference of use immediately before the collision. In short, where prosecutors tended to treat call data records summarised in police reports as objective corroboration, defence lawyers either sought personal verification (raw records, independent access) or highlighted limitations such as timestamp desynchronisation that sustain reasonable doubt.

CCTV

CCTV was uniformly given high weight among prosecutors (100%), while 60% of defence rated it high, again contingent on seeing the actual footage and on image quality/positioning.

Prosecutors characterised the CCTV as straightforward evidence of high weight. They expected it to depict a lack of evasive action, corroborate witness accounts, and fix location and timing (e.g., impact within the crossing; the victim's approach from a visible direction), thereby supporting sequence reconstruction. Reservations were minimal: one participant queried image quality and completeness of capture (resolution, potential frame loss) but still assigned high evidential weight to the item. Overall, the CCTV footage was framed as a powerful exhibit that visually anchors negligence and coheres the remaining traces (Erlandsen, 2019).

Defence lawyers were divided on the CCTV evidence. Sixty per cent rated it as high weight, typically on a conditional basis: it was valuable if the footage clearly showed the collision, verified timing, and had sufficient image quality. One defence lawyer rated the CCTV highly, describing it as ‘dumb’ evidence that cannot be influenced, provided timing and quality checks confirmed its reliability:

High. If it captures the collision, then it verifies everything the witnesses state, and also, what the suspect himself explains, for that matter. It is high because it is dumb. It cannot be influenced. It stands completely still, and this picture is the picture of that. Of course, I would then need to check the clock and the timestamps and assess the quality. To ensure it is indeed in real time, not ahead or behind. (P1)

Another accepted the footage as strong evidence of factual circumstances but cautioned that its significance for the question of indictment was limited:

I think that the video initially has high evidential value regarding where the pedestrian was when the car hit him. But the question is what significance, whether it has high or low significance for the question of indictment, that is not a given, right? But I do think it has a high evidential value concerning the factual circumstances that he was in the middle of the road, yes. But that it therefore has high evidential value for the indictment question, that I would not accept. So, I think one must distinguish between evidence of factual circumstances and how relevant those factual circumstances are for the indictment question. It is not necessarily decisive that he was in the middle of the road, I think. (P3)

Other defence lawyers were sceptical, assigning low weight where only a police summary was available, emphasising the need to view the raw video to assess resolution, camera position, and whether nuances (e.g., evasive manoeuvres) were discernible. Several also noted that, as described, the footage did not directly evidence phone use or the causation of negligence. In short, whereas prosecutors tended to treat CCTV as straightforward and compelling, defence evaluations were verification-led: high when directly accessible and technically adequate; low when mediated by second-hand description. A defence lawyer highlighted missing technical details, stressing that resolution and camera distance could affect whether nuances, such as minor evasive actions, were captured:

Yes, there is some information missing here. We do not really know. There is a description here that it shows the position of Peder Aas, and that the car did not attempt any evasive manoeuvre or braking. And here there is information we do not have, concerning the resolution of this camera, how well nuances are displayed. Could it be something with the resolution that causes delays or lag? And then, of course, there is also the distance, how clearly things are shown. That smaller movements, and perhaps a slight attempt at an evasive manoeuvre, would not be visible if the camera is quite far away. (P2)

Finally, one defence lawyer assigned low weight, rejecting reliance on a police summary and insisting on personally viewing the footage:

Because it is a police officer's account of that person's observations or how the police officer has observed and interpreted this CCTV footage. I would want to see that CCTV footage myself. (P4)

GPS data

GPS data showed smaller role-based differences. Sixty-nine percent of prosecutors assigned high evidential weight to the GPS data, while 67% of defence lawyers did the same.

Prosecutors were generally favourable to the GPS evidence, viewing it as an objective indicator of speed that corroborated the suspect's statement. Several noted that even if the average speed was below 50 km/h, in a dense traffic setting it could still support a negligence inference (e.g., brief high speeds or failure to stop). Sceptics argued the item was at best indicative: it derived from a manual analysis of an unspecified device, with unclear reliability and data-capture parameters, and thus required cautious interpretation. Overall, however, most prosecutors assigned high weight to the GPS when considered in combination with the other traces (Erlandsen, 2019).

Defence lawyers identified the GPS analysis as relevant, with a majority rating it high in evidential weight if verified. Several viewed it as corroborative, supporting eyewitness accounts of moderate speed or, when correctly analysed, strengthening the claim that the driver was not speeding excessively. One defence lawyer emphasised that GPS data could hold relatively high evidential value, particularly as corroboration of witness accounts indicating moderate speed and the absence of negligence:

I think that it would have had relatively high evidential value regarding the speed of the car, which could have been relevant. But here there is really nothing to suggest, the witness statements also do not indicate that she was speeding. So, well, the GPS would strengthen the witness statements in showing that the speed was not particularly high. So that there was no negligence, at least in relation to speed alone. So, regarding that aspect, I think it would have been relatively high. (P3)

Others linked it to the phone timeline, arguing that a timestamped GPS record could be read alongside Snapchat activity to situate distraction relative to impact. Sceptics gave the item low weight, noting that an average-speed calculation does not speak to culpable negligence at the critical moment, and expressing distrust of a police-authored summary without access to raw provider or device data. One defence lawyer questioned the analytical basis of the GPS evidence, stressing the need to review the conversion methods and formulas used, and noting that average speed alone may have little significance for the incident itself:

I would very much have liked to see that conversion. Is it only speed that one can obtain from that GPS? I know very little about cars and onboard computers and such things, but I can imagine that perhaps steering movements or possibly pedal use could be registered in such a driving computer. But if this is just GPS, then it would probably only be speed and direction. But I would want to have seen that conversion, and how the average speed was calculated and the formulas used. And then there is the matter of average speed, what significance does that have for the actual incident? (P2)

Concerns centred on device reliability and the manual nature of the analysis. Another defence lawyer underscored concerns about reliability and manipulation, insisting that GPS traces should be cross-checked against other information and that data-pulling frequency must be known to assess evidential value:

Digital evidence should not stand alone but should be checked against comparable information to verify whether it is truthful. For such things can be manipulated. I would also want to know how often the GPS pulls data. If you have a smartwatch, it pulls data itself. At least my Garmin can be adjusted. An Apple, I do not know. I would also have asked how often it checks its position. […] And you can see that in the output, by how far apart the points are. And if I know the timing of when it pulls data, each time it makes a mark, then I can almost calculate how fast it was going. That is what I would have asked about the GPS, how often it pulls data. (P1)

To summarise the analysis of the four items of digital evidence, both prosecutors and defence lawyers recognised the relevance of the digital traces, but their evaluative logics diverged. Prosecutors generally accepted the evidence as presented, treating police-documented timelines and provider records as technically sound. Several even described items such as the phone log as akin to laboratory results (Erlandsen, 2019). Defence lawyers, by contrast, were verification-led: even when assigning high weight, they did so conditionally (‘high if verified’), seeking raw data, primary files (e.g., the actual CCTV), provenance detail and, when necessary, independent expertise.

A consistent point of divergence concerned police-summarised evidence. While prosecutors were content with synopses and tabulated summaries, defence lawyers discounted such material, emphasising the lack of access to the underlying data and pointing to risks of interpretive error and missing technical parameters such as timestamp accuracy, resolution, and device reliability.

The roles also differed in how they linked individual items to the case theory. Prosecutors tended to integrate items into a cumulative narrative in which traces corroborated one another. Defence lawyers, by contrast, assessed items more often in isolation, asking what each could establish on its own. For example, they noted that an average speed reading does not, by itself, prove culpable negligence, and that a textual description of CCTV does not, by itself, prove phone distraction. Where timestamps or locations did not align across traces, defence participants reduced the weight they assigned.

Finally, the research reveals a ‘trust gap’: prosecutors’ acceptance of officially reported digital traces contrasts with defence lawyers’ insistence on verification and primary-source review. As cautioned by Erlandsen (2019), limited technical scrutiny on the prosecution side risks overvaluing weak or poorly documented traces. Conversely, defence scepticism has little practical effect if access to underlying data or expert support is constrained. Taken together, these role-conditioned differences set the stage for a broader discussion of how evidentiary practices and institutional structures shape the possibilities for meaningful defence scrutiny.

Discussion

This study relies on qualitative interviews and a scenario exercise, and the findings are contextual and exploratory. When considering the results, some limitations should be noted. First, selection bias is likely: participating defence lawyers were volunteers and may have above-average interest or experience with digital evidence, so their views may not represent the wider bar. Second, the self-report basis introduces recall and social-desirability effects. Moreover, qualitative inference may raise reliability concerns: results can vary with framing and interviewer. We mitigated these risks via a piloted scenario, a consistent semi-structured interview guide, and analytic cross-checks (peer debrief), but researcher positionality (background in criminal investigation and digital forensics) may still have shaped probing and interpretation. The small sample size does not allow for statistical generalisation but should rather be interpreted as indicating mechanisms and recurrent problems.

While previous studies have documented structural barriers to defence engagement with digital evidence (e.g., Goodison et al., 2015; Rajapakse, 2024; Wilson-Kovacs et al., 2023), few have examined how defence lawyers themselves interpret evidential weight and uncertainty in a controlled setting. This replication addresses that empirical gap. Notwithstanding the limitations, the analysis of the replication shows consistent role-conditioned differences in how prosecutors in Erlandsen's study (2019) and defence lawyers in the present study evaluate digital traces. These differences form the basis for a discussion of whether structural conditions and routine practices enable or hinder meaningful scrutiny.

Prosecutors tended to accept police-reported artefacts at face value and integrate them into a cumulative narrative, whereas defence practitioners in the present study adopted a verification-led stance, conditioning weight on access to primary material (raw files, telecom provider records, full CCTV footage) and on explicit provenance and uncertainty information. If this represents a more generalised stance among defence practitioners, this ‘trust gap’ matters for Article 6 of the ECHR: where one side proceeds on institutional trust and the other on demonstrable verification, equality of arms is contingent on disclosure practices and on the practical availability of expert support.

Two mechanisms appear to drive the divergence. First, defence participants in the present study systematically discounted police-summarised items (e.g., textual descriptions of CCTV and tabulated telecom extracts) unless they could inspect the underlying data. Prosecutors, participating in Erlandsen's (2019) study, by contrast, generally treated summaries as faithful proxies. Second, defence participants reduced weight when timestamps or locations did not reconcile across sources (e.g., mobile phone activity logs versus network records), while prosecutors were more willing to treat partial inconsistencies as non-dispositive within an overall case theory. Both mechanisms underscore that evidential weight is sensitive not only to content but to presentation and provenance.

While Crimmins (2021) found comparable knowledge levels concerning digital traces as evidence between prosecutors and defence lawyers, our findings suggest that defence lawyers operationalise this knowledge differently, applying it through verification-led reasoning and conditional trust. This indicates that how digital evidence is understood and evaluated does not merely rely on knowledge, but rather on their role in the legal system. Their ability to critically scrutinise the evidence is further mediated by their access to information and context.

These findings have direct implications for reporting and disclosure. First, digital-evidence reports should clearly indicate their primary-source dependencies, such as whether the account is based on a police summary or an original record. Furthermore, the results show that legal professionals often lack the competence to recognise the uncertainty inherent in the evidence. Investigative reports should therefore include plain-language uncertainty statements, while formal evaluations ought to follow established reporting standards described in the guidelines by European Network of Forensic Science Institutes (ENFSI) (2015) and ISO 21043:2015 Parts 3–5 concerning Analysis, Interpretation, and Reporting (International Organization for Standardization, 2025a, 2025b, 2025c). Second, timely provision of underlying material (e.g., actual CCTV video files, mobile phone extraction files) is central to adversarial testing; without it, role-based differences risk hardening into structural disadvantage for the defence. This access is not only important for the verification of the traces themselves, but also for seeking alternative explanations of their meaning based on their context. This underscores the necessity of not only disclosing interpretations of results to the defence lawyer, but also the data underpinning these interpretations.

The results also speak to the quality assurance landscape. Internal quality control should not be bypassed under the assumption that defence counsel has the capacity or resources to uncover critical errors in digital evidence. Defence lawyers highlighted relevant limitations of the evidence and the need for verification. If quality control measures such as a peer verification review had been performed, where a second digital forensic examiner had reviewed and verified the findings (see Horsman and Sunde, 2020), these issues might have been identified earlier. For instance, a properly conducted peer verification of the mobile phone activity log would most likely uncover that the Snap message was not sent by the driver at the time indicated in the police report. From a legal-security perspective, strengthening routine quality assurance and aligning disclosure with these practices would both improve intrinsic evidence quality and make defence lawyers scrutiny more focused and efficient.

Although the defence lawyers in our study were often able to identify limitations and potential flaws in digital forensic reporting, the statutory architecture places the primary responsibility on the prosecuting authority and the court to ensure that the evidential record is complete and balanced. Where a specific person is under suspicion, the investigation must seek to clarify both the evidence against and the evidence in the suspect's favour, and the court must, in its own capacity, ensure that the case is fully clarified, including by obtaining new evidence when necessary. Disclosure and access are the practical consequences of these duties: the suspect and defence counsel are entitled to acquaint themselves with the case documents to the extent necessary to safeguard their interests, and any restriction on access requires strict necessity and must not create substantial doubts as to the defence. Against this backdrop, our findings indicate that while defence scrutiny may operate as an important, case-specific safeguard, relying on individual proceedings to expose methodological weaknesses is neither systematic nor reliable. A Norwegian analogue exists in the proposal for a Forensic Technical Commission in serious traffic cases, intended to provide independent review akin to the Norwegian Board of Forensic Medicine (Norwegian Attorney General, 2015). Extending this suggested oversight model to digital forensics would institutionalise quality assurance, ensuring that expert assessments are subject to routine external scrutiny rather than sporadic adversarial challenge. The role-conditioned differences identified in our study underscore the need for such structural mechanisms: the defence consistently highlighted verification deficits that could, in principle, be mitigated through independent oversight and mandatory validation routines.

Taken together, our findings affirm that the reliability of digital evidence is not solely a matter of technical accuracy, but of institutional process and role-based scrutiny. As highlighted by Sunde (2017) and Heitmann and Franke (2023), competence and structural gaps persist despite increasing digitalisation. Our case study adds new empirical weight to this concern, showing how prosecutors and defence lawyers approach the same traces through markedly different evidentiary logics. If defence scrutiny is to function as a meaningful safeguard, it must be structurally supported through disclosure, training, and independent oversight. Unless these role-conditioned differences are structurally addressed, digital evidence risks entering the courtroom with a veneer of objectivity that escapes adversarial testing, undermining the core safeguards of a fair trial.

Finally, targeted training for legal professionals should be framed as a fair-trial safeguard rather than optional upskilling. Such training should cover how digital evidence is created, preserved, and presented, including chain of custody, hashing, and interpretation of metadata and logs across common sources (cell phones, computers, digital platforms, CCTV, telecom), so that counsel can identify when summaries or extracts require inspection of underlying data. It should also develop procedural competence in making targeted disclosure and access requests, working effectively with independent digital forensics expertise (including limits of tools and inference) and framing provenance and reliability challenges in fair trial and equality of arms terms under Article 6 of the ECHR. Article 6 of the ECHR requires not only formal representation but effective participation, which presupposes the ability to interrogate the relevance and reliability of digital traces. Anchoring these measures in procedural rights clarifies their purpose: to operationalise equality of arms through informed, testable scrutiny of complex technical claims (Council of Europe, European Court of Human Rights, 2022).

Conclusion

Our study shows a clear, role-conditioned, divergence in how legal professionals evaluate digital evidence: while prosecutors in Erlandsen's (2019) study often accept police-reported digital traces at face value, defence lawyers adopt a verification-led approach, assigning high evidential weight only when the evidence is corroborated by primary data, confirmed provenance, and technical consistency. These findings show that institutional practices related to reporting and disclosure shape what is assessed as credible and trustworthy evidence. Although similar dynamics may plausibly arise in other technically mediated forensic domains (for example, DNA profiling), the present study concerns digital traces only and cannot support domain-general conclusions; this is therefore a relevant question for targeted comparative research.

The analysis further underscores that equality of arms under ECHR Article 6 requires more than formal access to legal representation; it demands that defence lawyers have the knowledge and technology necessary to interrogate the reliability, interpretation, and limitations of complex digital traces.

From a policy and procedural perspective, this underscores the need for systemic reforms. First, digital forensic reports should clearly distinguish between original data and summarised findings, include plain-language uncertainty statements, and disclose methodological choices. Second, early and complete disclosure of raw digital material and supporting documentation should be routine, not discretionary. Third, internal quality control mechanisms, including peer reviews by independent digital forensic examiners, must be institutionalised to reduce the risk of flawed or overstated evidence reaching court unchallenged. Finally, legal professionals, both prosecutors and defence, require targeted training to improve their ability to engage with digital evidence critically and effectively.

Ultimately, the reliability of digital evidence is not solely a function of its technical generation but of the legal system's ability to evaluate it through fair, informed, and adversarial processes. When defence scrutiny is weakened by structural or informational deficits, the fact-finding process itself is compromised. Ensuring that digital evidence is subject to robust and equal review is not a technicality, it is central to safeguarding the fairness and integrity of criminal adjudication.