Some criminal defendants erroneously believe that simply because they may have hired a good attorney, they don’t need the assistance of a computer forensics expert witness.  In this case, this happened in a case that could have used a computer forensics expert witness in Richmond Virginia.  The facts of that case where as follows:  An Agent for Immigration and Customs Enforcement (“ICE”) conducted an investigation into a foreign child pornography website, “Illegal.cp,” which, for $79.99, offered 21 days of access to material containing child pornography. When a user purchased such a 21-day membership, the charge to his credit card was discretely labeled “AdSoft.”  Nominally, AdSoft is/was a company that sold software products. An ICE agent involved in the Illegal.cp investigation confirmed, however, that she was unable to purchase any legitimate software products from AdSoft.

Matthew Russo came to ICE’s attention during an investigation of the Illegal cp website. Based on ICE’s investigative findings, two ICE agents conducted a “knock and talk” with Mr. Russo at his residence. Although the conversation was at first light and civil, the atmosphere intensified when the agents asked Mr. Russo about charges to his debit card. At that point, Mr. Russo said something to the effect of, “what are you here for-Guns? Child Porn? Money?,” without the agents having first mentioned the subject of child pornography. The agents then examined Russo’s debit card and seized two computers from the household.

An ICE Forensic Expert examined the two computers, one of which was found to contain several items of evidence. First, hundreds of child pornographic images were found in the AOL cache folder, having been downloaded to that folder between February and September 2007, based on the internet browsing of an AOL user with the username “rdendron.”  Second, hundreds more images were found in the unallocated space of the computer’s hard drive. The ICE Forensic Expert testified that the computer’s operating system automatically transferred these images from folders such as the cache folder. Third, dozens of sites, with names advertising child pornographic content, were bookmarked as “favorites” on the rdendron profile. Fourth, the Internet Explorer web browser’s history revealed that several such child-pornographically named sites had been visited by a user on that computer. A second username for this computer had no pornographic images associated with it. The ICE Forensic Expert, who was well qualified in his field, came to the conclusion that Russo had made significant efforts to access websites containing child pornography. The Forensic Expert, along with another ICE Agent, then interviewed Russo, and, during the interview, Russo stated that the rdendron profile was his, and he admitted to viewing child pornography, among other types of pornography.

Russo called no witnesses and presented no computer forensics evidence whatsoever.  He simply vigorously questioned the sufficiency of the Government’s evidence at trial. He successfully argued for excluding some significant items of the Government’s evidence. He also presented alternative theories of how the hundreds of images and dozens of websites appeared on his computer.  The result: a conviction and a lesson learned for a client and his attorney.

This computer forensics example has been presented by AVM Technology, LLC, a leading Computer Forensics, E-Discovery, and Computer Security consulting company located in Richmond, VA and serving clients throughout the United States.