Adli Bilişim

Observing that with the spread of information technologies the commission of offences and the storage of evidence have shifted to the digital environment, this study examines the discipline of "digital forensics" — the process of collecting and examining evidence in that environment — and the principal problems encountered in Turkish practice. The author emphasises that digital forensics has become indispensable not only for cybercrime but for the elucidation of every kind of offence whose evidence is stored digitally.

The Concept and Importance of Digital Forensics

Digital forensics is the process of collecting, examining and analysing electronic evidence in information systems within an investigation, and reporting it to the judicial authorities. The process aims to reach the material truth in a lawful manner. Because e-evidence can easily be altered or destroyed, the field demands special expertise and requires the evidence to be handled by correct procedures from the moment of first contact.

Principal Problems in the Field

The article gathers the problems encountered in Türkiye under six main headings:

• Shortage of expert personnel: there is a serious deficiency of training and staff, both at the level of technical experts and among the police, prosecutors and judges who handle such evidence. The migration of trained personnel to the private sector for better salaries is a further problem.
• Difficulty of obtaining e-evidence: beyond the difficulty of locating the relevant item among billions of data, one of the greatest obstacles is the inadequacy of international cooperation in obtaining evidence from companies based abroad, notably social-media platforms. The 24/7 assistance network under the Council of Europe Convention on Cybercrime, to which Türkiye is party, is not used effectively.
• Violation of privacy: the high risk of intruding, during the search for evidence, upon personal and private data unconnected with the offence is a significant problem.
• Improper preservation of evidence: seized computers and storage devices are not kept in physical conditions (humidity, temperature, protection from magnetic fields) that would prevent deterioration; judicial depositories generally lack this infrastructure.
• Inadequate technical equipment: because public-procurement bureaucracy cannot keep pace with technology, forensic laboratories fall technically behind.
• Errors in search-and-seizure procedure (CMK Art. 134): the author argues both that Article 134 is itself inadequate and that it is misapplied in practice: the principle that a digital search is a "last resort" is not observed, such searches being ordered routinely alongside physical searches; the examination of mobile telephones by the police without a judge's or prosecutor's order is a widespread illegality; although the statute envisages taking a copy of the data and returning the device, in practice devices are seized wholesale, "by the sackful"; and the provision itself — with its narrow concept of "computer", its failure to allow remote (online) searches and its requirement that data be printed on paper — is inadequate in the face of today's technology.

Conclusion and Recommendations

The author proposes the establishment in Türkiye of a Digital Forensics Institution separate from the Forensic Medicine Institution, independent and with an autonomous budget. It is further emphasised that Article 134 of the CMK must urgently be re-drafted so as to encompass modern investigative powers — notably remote and online searches — while protecting fundamental rights.