Cases gone bad....

Another case that I have covered in the past is was the case of Larry Benedict. An entire series of articles was online at one time that highlighted some of the mishandlings in this case; see
http//news.cnet.com/2100-1023-955961.html

An interesting case which reminds me very much of the Little Rascals Day Care Case in Edenton, NC

http//www.pbs.org/wgbh/pages/frontline/shows/innocence/

But, as in that case, the problem is a legal one not an evidentiary one. Unless the defense can argue that the plea was coerced, there is not much that anyone can do. It appears, from a brief reading, that the defense didn't do a particularly good job but the problem is that the defendant plead guilty. It is very hard to get a plea overturned.

The case does suggest the need for court-appointed special masters or experts in issues like this. Defendants are entitled to court appointed attorneys and even court appointed psychiatrists so why not court-appointed forensic experts.

Since we are neutral experts, finding data like that posted by AWTLPI is not bad, it just is stating the facts. That is what we do.

Our purpose is not to exonerate or convict. Our purpose is to find and present the facts.

Since we are neutral experts, finding data like that posted by AWTLPI is not bad, it just is stating the facts. That is what we do.

Our purpose is not to exonerate or convict. Our purpose is to find and present the facts.

I think that what you are saying is the ideal, but the reality is often different. In civil law, while you are required not to lie or manufacture evidence you are not, as required in criminal law, required to provide evidence for the opposing party. Even in criminal law, while the prosecution is required to make available any evidence which might exonerate the suspect (e.g. Alaskan Ted Stevens), the defense is not required to produce evidence of the defendant's guilt.

Our system was designed as an adversarial system. While the purpose of the Court is to determine the truth as best as it can be determined, it is the attorney's job to represent his or her client to the best of his/her ability. Experts retained by either party are expected to be advocates for their clients. If they cannot, in good conscience (and I have so done), represent their clients, they should withdraw from representing them.

A few years back, a physican was retained as a medical expert in a malpractice case. In his initial testimony, he testified that he did not believe that malpractice had occurred but during a recess he reread the record and, on the stand, changed his position. The plaintiff won the case and the defendant sued the "expert" for malpractice and won.

I'm not saying that we are hired guns but what I am saying is that it is the attorney's job to determine how to present their client's case. Our job is to determine the facts and any expert opinions which could be supported by those facts, but I wouldn't say that, in most cases, that means being "neutral".

Good points Sean. I should have used the word "independent" rather than neutral.

By the way, I am looking for good cases to use in my book. I plan to cover the Julie Amero and Scott Peterson cases.

Any other cases, civil or criminal that are of interest would be appreciated as long as I can get copies court documents or find them online.

Good points Sean. I should have used the word "independent" rather than neutral.

Thank you, Larry. And, as an example, in one case, my client claimed that he could not have copied files from an external device to his home computer hard drive because he was out of town the day that this, supposedly, happened. I instructed his counsel that the computer evidence suggested otherwise, namely, that the date and time information indicated that someone had accessed his computer and attached the external device on the day in question and since my client had already testified in deposition that he had sole possession of the external device, it almost certainly had to be the case that he was in possession of the computer on that date.

Upon requestioning the client, the attorney learned that the client had taken the home computer with him when he was out of town (the client did not even remember having done this). The other side never learned this fact, or if they did, they chose not to present it, but the evidence that I obtained helped my client's attorney to see the potential weaknesses in his case.

I believe that this is an example of what you mean by "independent". My investigation determined that the client's recollection was likely to be flawed. Had I been asked on the stand whether my examination supported the client's contention that he could not have copied the files on the day in question, I would have had to answer in the negative. But my job, as I saw it, was to inform my client's counsel of all the evidence whether it supported or refuted my client's testimony. Unless I had evidence of a crime, it was not my duty to present all of my findings to the court.

What, specifically, is your book about? That might help me to know if the cases on which I have worked have any relevance.

Speaking of which, I will tell you of a case that I worked on where the subject was accused of stealing proprietary business algorithms from a former employer and using the logic to start his own business.

The plaintiff, whom I represented, requested a forensic examination of the defendant's home computer, which he also used for his startup business. It was also a family computer and the defendant's lawyer opposed such a blanket examination as unreasonable (on the grounds of expectations of privacy). The judge agreed with the defendant and, against my recommendation, ordered a limited examination of the computer, to be done at the offices of defense counsel, witnessed by defense counsel and the defendant. I was allowed to look at any file on the computer but the defense was allowed to object to my taking specific files.

Because this was a building contractor, images, AutoCAD drawings, TIFF faxes, etc., were not exempted from the search.

In a room full of people, including the defendant, I uncovered images of his 16 year old daughter that she had taken and e-mailed to "friends" including images which could possibly have qualified as CP. Although the local Federal Attorney concluded that the defendant was totally unaware of the presence of these on his computer it was, nonetheless, a significant embarrassment for the defendant to have these pictures viewed by his counsel and other clients.

In response Larry Daniel regarding cases you might use, the Kwame Kilpatrck case hinged on text messages. You can get the full transcript on line. At one time you could get to it from freep.com the local paper.

The question was not around content and not totally about the content being altered, but admissibility. Privacy was discussed and public policy. At least this was my interpretation. It is a good read and Kim Worthy did an excellent job arguing it.

The funny thing is that the defendents admitted to sending the content. It always seems we are questioned more on our method and process as opposed to the actual content. That is our role. I always say "we only use our powers for good". wink

Here is the proposed title and synopsis for the book. Sadly most of my cases cannot be used because of confidentiality.

Title Computer Forensics; Real World Case Analysis

Sub-Title A case level guide to analyzing cases involving digital evidence in criminal and civil actions

This book is about analyzing cases involving digital evidence on a case level, rather than on a specific technical level. The purpose is to show different approaches and techniques for analyzing evidence in context of a case, both in civil and criminal actions.

This book will involve reviewing famous cases, such as the Scott Peterson case, the Julie Amero case and others to look at the analysis methods used and the results of those cases, as well as case scenarios proposed from the author’s own files and experience. The purpose is to review as many different types of civil and criminal cases as possible to explain both strong and weak approaches to case analysis and common mistakes made by both novice and experienced examiners.

In cases that have published testimony, the author will propose alternatives to the examination questions posed to show alternative approaches to examination of the experts in those cases.

While the author is not an attorney and none of his examples should be taken as legal advice, he can use his experience in cases to show weaknesses and strengths in different approaches to examining digital forensic experts in the case examples. This will also help to prepare examiners for the possibility of testifying in court by giving them examples of lines of questioning based on specific types of cases.