Digital Evidence Standards

The FSR is the statutory officeholder responsible for setting and enforcing standards for forensic science activities used in criminal proceedings in England and Wales. The current Regulator is Dr Marc Bailey, who succeeded Gary Pugh. The remit covers the full range of forensic activities producing evidence used in court, DNA, fingerprints, toxicology, digital data analysis, cell site evidence, device examination.

Before the Forensic Science Regulator Act 2021, the FSR was non-statutory. Standards were guidance. Compliance was voluntary. Forces and private providers could and did fail to comply. The 2021 Act made the FSR a statutory officeholder, required a statutory Code of Practice, and gave the Regulator power to investigate non-compliance, issue compliance notices, and halt forensic activities that risk prejudicing criminal proceedings.

The first statutory Code came into force in October 2023. Version 2 followed in 2025, with a transitional compliance period to October 2025. The Code covers 51 defined forensic science activities, of which 34 are currently subject to its full requirements. Digital forensics is within scope. The Code requires a documented quality management system, ISO 17025 accreditation from UKAS for most regulated activities, validation of all methods and software tools, documented chain of custody, regular proficiency testing, and a named Senior Accountable Individual.

ISO 17025 is the international standard for testing and calibration laboratories. It means processes, personnel, methods and results have been independently assessed by UKAS and meet defined international standards for competence and impartiality. It is not a one-time certificate, it requires ongoing compliance, regular surveillance assessments, and proficiency testing.

Digital forensics is one of the areas most affected by the Code because it is where accreditation compliance has historically been most patchy. For years, forces conducted device examinations using in-house digital teams with no external accreditation, no validated methodology, and no documented quality management system. That evidence was then placed before courts without the quality assurance physical forensics had been required to meet. Achieving accreditation is resource-intensive. HMICFRS Operation Soteria (August 2024) and the investigating crime thematic inspection (March 2025) both found significant gaps remain.

What accredited digital forensics requires

An accredited examination requires named, qualified examiners; documented extraction methodology; validated forensic software (Cellebrite, MSAB XRY, Magnet AXIOM must be validated for the specific task); documented chain of custody from seizure to analysis; an extraction log recording what was found and what was not; and a formal expert report suitable for court. Each element can be challenged in cross-examination. The absence of any of them is significant.

The cases VNS documents frequently involve what forces describe as examination by a 'digital team', an internal examination by unnamed officers or civilian staff using unspecified software, producing no formal expert report, no extraction log, no named examiner, no methodology documentation. This is not accredited forensic examination. It is unregulated internal examination that does not meet the Code.

• Has a formal forensic report been served? If not, why not?
• Who conducted the examination and what are their qualifications?
• Is the examining unit accredited to ISO 17025 by UKAS?
• What extraction software was used and has it been validated?
• Is there an extraction log recording what was found and what was not?
• Has the unused material schedule been reviewed for any reference to device examinations?
• If the MG6C records examination by a 'digital team' with no further detail, has specific disclosure been requested?
• Has the defence considered instructing its own accredited digital forensic expert?