One common misconception of an examiner’s analytical responsibilities is that he or she is to only analyze submitted evidence to the extent of the investigative request. This is far from the truth. Indeed, if this is all that an examiner does, then most probably, technical support personnel can be trained to do the task.

Since the examiner is often also the investigator in a digital forensic investigation, can we be assured that he is “disinterested” in the outcome of the case? After all, he found evidence of a crime and it was located on the subject’s computer. From his perspective, case closed. However, has he provided all of the significant physical facts relative to the investigation to the prosecutor? Having found child pornography, should he not attempt to determine its source? Everyone is presumed innocent until proven guilty (or pleads guilty). Even though the subject is charged with an insidious crime, he himself could be a victim. It is possible that a more thorough forensic examination may conclude that no determination could be made as to the source of the child pornography pictures (subject downloaded the pictures, received them via an e-mail, they were put onto the computer via another methodology, etc.). At that juncture, it would be up to a judge and/or jury to decide guilt or innocence based upon all the facts in the case. Regardless, from an ethical and professional perspective, every examiner has the responsibility to not only examine the evidence for probative data, but should also provide potential exculpatory evidence to the prosecutor “to the end that all may fully understand and be able to place the findings in their proper relationship to the problem at issue.”

From: Ethical Practices for Digital Forensic Examiners by John Barbara