Computer Forensics Report -- Expert Witness

	*THE LEGAL EXPERT NETWORK* Complete Your Search With One Call 1-800-597-5371

Home

About Us

The Devil’s Advocate:
Computer Forensics Can Support Both Sides of Computer Litigation
By Judd Robbins

About the Author:
Judd Robbins is a well known computer specialist who serves as both an expert witness and a litigation consultant. With his technical credentials, more than 30 years of computer experience, and over a decade of case support, he can dramatically assist you in discovery, preparations, and analysis for cases involving intellectual property, computer forensics, software piracy, data recovery and file deletions, pornography on the Internet, database systems, computer programming languages, and the Year 2000 (Y2K) Problem. Mr. Robbins has both deposition and trial testimony experience and is the best-selling author of thirty books as well as the star of more than twenty videos and CDs on software subjects.
These are some of the keywords associated with this expert's work experience and/or field of study: Expert Witnesses, Legal Experts, Consultants / Consulting, Forensic, Litigation, Arbitrations, Depositions, Trials, Mediations, Courts, Forensics, Criminal Cases, Civil Cases, Law Suits, Testify, Testimony, Torts, Laws, Lawyers, Attorneys, Malpractice, Computers, Software, Hardware, Internet, Y2K (Year 2000) Problems, Engineering, Telecommunications, Evidence & Data Recovery, Database Systems, Computer Networks / Networking, Patents, Personal & Business Computers (PC's), Intellectual Property / Properties, Advertising / Marketing / Promotions, Websites (Web Sites), E-mails (Emails), Piracy, Components, Chips, Microprocessors, Semiconductors, Compression, Diskettes, Files, Storage, Deletions, Packaging, Electrical, Electric, Electronics, Sciences, Training, Security, Loss, Failures, Infringements, Trade Secrets, Pornography, Filtering, Programming, Languages, Programmers, Games, Applications, Architecture, Fraud, The Internet, Technology / Technologies, Communications, Media, Modeling, Users, Virus, Hackers, Reliability, Testing, Performance, Simulations, Services, Analysis, Designs, Animations, Graphics, Circuits, Macs (Apple Macintosh), Microsoft, Wiring, Displays, and Appraisals.
This expert will consult with attorneys / clients that are located in: AK (Alaska), AL (Alabama), AR (Arkansas), AZ (Arizona), CA (California), CO (Colorado), CT (Connecticut), DC (District of Columbia), DE (Delaware), FL (Florida), GA (Georgia), HI (Hawaii), IA (Iowa), ID (Idaho), IL (Illinois), IN (Indiana), KS (Kansas), KY (Kentucky), LA (Louisiana), MA (Massachusetts), MD (Maryland), ME (Maine), MI (Michigan), MN (Minnesota), MO (Missouri), MS (Mississippi), MT (Montana), NC (North Carolina), ND (North Dakota), NE (Nebraska), NH (New Hampshire), NJ (New Jersey), NM (New Mexico), NV (Nevada), NY (New York), OH (Ohio), OK (Oklahoma), OR (Oregon), PA (Pennsylvania), PR (Puerto Rico), RI (Rhode Island), SC (South Carolina), SD (South Dakota), TN (Tennessee), TX (Texas), UT (Utah), VA (Virginia), VT (Vermont), WA (Washington), WI (Wisconsin), WV (West Virginia), & WY (Wyoming).

If you would like additional information about the author's services as an expert witness and/or consultant, contact the Legal Expert Network at 1-800-597-5371.

Computer forensics is simply the application of computer investigation and analysis techniques in the interests of determining potential legal evidence. Evidence might be sought in a wide range of computer crime or misuse, including but not limited to theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer specialists can draw on an array of methods for discovering data that resides in a computer system, or recovering deleted, encrypted, or damaged file information. Any or all of this information may help during discovery, depositions, or actual litigation.

GIVE THE DEVIL’S ADVOCATE HIS DUE

Just as statistics is often used on both sides of many arguments, so are computer specialists. Although the experts sometimes present diametrically opposing positions, it is more likely that the lawyers involved in the case choose to elicit differing but not truly conflicting statements. Experts can readily help on either side of a case, either to identify helpful prosecutorial facts or to suggest alternative possibilities to create reasonable doubt. Experts are counseled not to be advocates, and they need not be when the facts alone offer sufficient material for legal presentation. Experts are told to answer Yes or No and not give any more than is asked. However, experts are also expected to know when to refuse to give a simple Yes or No when a more expanded answer is truly necessary to clarify a response.

In Alabama recently, I testified for the defense in a military court martial trial in a case that involved possible use (or misuse) of the Internet for interstate trafficking in child pornography. Computer experts were engaged on both sides of the issue, and there was no contention between their expert opinions. The prosecution expert conducted the original forensic exploration of the defendant’s computers. He presented his facts about files, both existing and deleted, that were found there. No argument there. However, the Defense was able to note some degree of inattention to the Federal guidelines for search and seizure of computer evidence. This led to discussions of the ease with which anybody can change the various dates and times associated with computer files. Reasonable doubt?

The prosecution presented lists of photographic images that were downloaded from the Internet. No argument there. Many thousands of images await interested viewers on the Internet, and an increasingly large percentage of those are pornographic. However, if more than one person has access to the same Internet account via a common password (and a girlfriend in this case did have that kind of easy access to the defendant’s computer), who is to say which person was actually responsible for downloading the photographs found on this defendant’s computer. Reasonable doubt?

Medical evidence was brought in by the prosecution to confirm the fact that some of the pornography was of women under the age of 18. In this case, a defense medical witness spoke to the uncertainty of age determination. The defense computer expert then spoke to the ease with which photographic retouching can modify digital pictures. Not that any picture in the case was actually manipulated digitally, but only that it can and could have been done with alarming ease and subsequent difficulty in ever determining if it was ever done. More reasonable doubt?

The list can go on, and in some cases, it certainly does. The computer forensics expert can unearth incredibly damaging evidence on computer disks. It’s the prosecution’s job to use that evidence to cement their case. But the computer forensics expert can also help the defense to identify any weaknesses in procedure or results that can help cast reasonable doubt on the apparent findings. It’s the defense counsel’s job to ascertain where and what weaknesses may exist and bring them to the fore.

BENEFITS OF PROFESSIONAL FORENSIC METHODOLOGY

The impartial computer expert who helps during discovery will typically have experience on a wide range of computer hardware and software. This is always beneficial when your case involves hardware and software with which this expert is directly familiar. But fundamental computer design and software implementation is often quite similar from one system to another, and experience in one application or operating system area is often easily transferable to a new system.

Unlike paper evidence, computer evidence can often exist in many forms, with earlier versions still accessible on a computer disk. Knowing the possibility of their existence, even alternate formats of the same data can be discovered. The discovery process can be served well by a knowledgeable expert identifying more possibilities that can be requested as possibly relevant evidence. In addition, during on-site premises inspections, for cases where computer disks are not actually seized or forensically copied (see below), the forensics expert can more quickly identify places to look, signs to look for, and additional information sources for relevant evidence.

I was a designated prosecution expert earlier this year in a case in Las Vegas, Nevada. During Discovery, the attorneys for the prosecution were going to ask for most of the obvious things about the subject software that had allegedly performed inadequately. But they hadn’t planned to ask for any earlier versions of the software in question; these versions may have still existed on the computer systems of the developing programmers or on the backup tapes of the developing software firm. These historical versions could have included helpful historical comments or earlier code that might have helped the determination of current software inadequacy. Similarly, any forensics exploration of a computer system should consider the existence and relevance of earlier versions of data files (eg. memos, spreadsheets) that still exist on the computer's disk or on backup media, or differently formatted versions of data, either created or treated by other application programs (eg. word processing, spreadsheet, e-mail, timeline, scheduling, or graphic).

Protection of evidence is critical. A knowledgeable computer forensics professional will ensure that a subject computer system is carefully handled to ensure that:

· no possible evidence is damaged, destroyed, or otherwise compromised by the procedures used to investigate the computer.
· no possible computer virus is introduced to a subject computer during the analysis process.
· extracted and possibly relevant evidence is properly handled and protected from later mechanical or electromagnetic damage.
· a continuing chain of custody is established and maintained.
· business operations are affected for a limited amount of time, if at all.
· any client-attorney information that is inadvertently acquired during a forensic exploration is ethically and legally respected and not divulged.

STEPS TAKEN BY COMPUTER FORENSICS SPECIALISTS

The computer forensics specialist will take several careful steps to identify and attempt to retrieve possible evidence that may exist on a subject computer system. These steps include:

· Protecting the subject computer system during the forensic examination from any possible alteration, damage, data corruption, or virus introduction.
· Discovering all files on the subject system. This includes existing normal files, deleted yet remaining files, hidden files, password-protected files, and encrypted files.
· Recovering all (or as much as possible) of discovered deleted files.
· Revealing (to the extent possible) the contents of hidden files as well as temporary or swap files used by both the application programs and the operating system.
· Accessing (if possible and if legally appropriate) the contents of protected or encrypted files.
· Analyzing all possibly relevant data found in special (and typically inaccessible) areas of a disk. This includes but is not limited to what is called 'unallocated' space on a disk (currently unused, but possibly the repository of previous data that is relevant evidence), as well as 'slack' space in a file (the remnant area at the end of a file, in the last assigned disk cluster, that is unused by current file data, but once again may be a possible site for previously created and relevant evidence).
· Printing out an overall analysis of the subject computer system, as well as a listing of all possibly relevant files and discovered file data. Further, provides an opinion of the system layout, the file structures discovered, any discovered data and authorship information, any attempts to hide, delete, protect, encrypt information, and anything else that has been discovered and appears to be relevant to the overall computer system examination.
· Providing expert consultation and/or testimony, as required.