In criminal cases computer forensics play a critical role.  Throughout the United States, prosecutors are aggressively prosecuting cases involving computer trespass (hacking, or violation of the Computer Fraud and Abuse Act), access device fraud, credit card fraud, possession and distribution of child pornography and solicitation of a minor via I

...

In criminal cases computer forensics play a critical role.  Throughout the United States, prosecutors are aggressively prosecuting cases involving computer trespass (hacking, or violation of the Computer Fraud and Abuse Act), access device fraud, credit card fraud, possession and distribution of child pornography and solicitation of a minor via Internet chat room.  A computer forensics expert will examine what can be found as well as what is hidden.   Often, this results in exculpatory evidence or in identifying flawed analysis by the government's computer examiners, which may render the evidence as inadmissible.  See also: What is computer forensics?

Some examples of criminal cases that involved computer forensics include:

U.S. v. McNair - Case involving computer forensics in child pornography decided in the Court of Appeals for the Fifth Circuit, originally decided int the United States District Court for the Western District of Texas.  The defendant was accused of distribution and receipt of child pornography and possession of a computer containing child pornography, in violation of 18 U.S.C. § 2252(a)(2), (a)(4)(B). His prosecution arose out of an investigation into a file-sharing network that led agents to defendant through a username associated with his internet protocol (IP) address.

U.S. v. Canoe - Case in which a computer forensics expert was involved after an agent was using LimeWire to locate people using file-sharing programs to trade child pornography. LimeWire is a file-sharing program that can be downloaded from the internet free of charge.  The case was heard in the Court of Appeals for the Ninth Circuit, originally decided in the United States District Court for the Central District of California in Los Angeles.

U.S. v. Pruitt - Case in which a defendant was accused of using his work computer to access and view child pornography images when he had no work-related purpose for accessing the images. At issue was whether the evidence was sufficient to prove that defendant knowingly received child pornography on his work and home computers in violation of 18 U.S.C. 2252A(a)(2)(A).   This is a Georgia case in the Court of Appeals for the Eleventh Circuit.

U.S. v. Moore - Case where a computer forensics expert examined a mobile device to find a photograph to support the charge of possession of a firearm by a convicted felon.  This is a Kansas case in the Court of Appeals for the Tenth Circuit.

U.S. v. Flyer - Case where the defendant was convicted in federal district court under 18 U.S.C. § 2252 (2004) for two counts of attempted transportation and shipping of child pornography (Counts One and Two); one count of possession of child pornography on the unallocated space of a Gateway computer hard drive (Count Three); and one count of possession of child pornography on CDs (Count Four).  The case involved the use of lime wire and was an Arizona case, the final decision came from the U.S. Court of Appeals for the Ninth Circuit.

U.S. v. Lynn - Computer forensics in a conviction in Lime Wire related case in federal district court under 18 U.S.C. § 2252.   In this case a gents seized laptops and through computer forensics analysis videos and images of child pornography.  The images had been downloaded using Limewire, a peer-to-peer file sharing program.  The Limewire program and the “Gnutella” network permit users to share files over the Internet. Once individual users or “peers” download the Limewire software to their computers, they can access dynamic indexing servers within the network that store information about the files being shared by other peers in the network. A Limewire user can conduct a search of those files, pull up a list of users that have a file meeting the search criteria, and then download files that they want directly from other peers. Upon downloading the program, a Limewire folder is created on the hard drive, with sub-folders called “Incomplete,” “Shared,” and “Saved.” When a user downloads a file using Limewire, the file begins to download into the folder marked Incomplete. After the download is complete, the file is placed in the Saved folder, where by default it can be accessed by other members of the network.

U.S. v. Morales-Aldahondo - The case involves computer forensics in a child pornography investigation in Puerto Rico.  An investigation of a subscriber site led to the discovery of large amounts of child pornography on appellant's and appellant's brother's computers.  Appellant's theory of defense was that the pornographic images at issue were placed on his computer by his brother. The government sought to prove that the pornographic images on appellant's computer belonged to him by tying the meticulous nature of the evidence's storage to him. The government's computer forensics expert  prepared a report containing the images and detailing their storage, as contrasted with appellant's brother's more chaotic storage methodology. Defense counsel sought to prevent the introduction of the images and movies into evidence by stipulating that the evidence met the statutory definition of pornography. The government rejected the proposed stipulation, and, over a defense objection, the court permitted the introduction of 12 images and 10 video clips. The jury convicted appellant.  Appellant appealed the decision, arguing that the district court should have suppressed the incriminating evidence because it was obtained pursuant to a search warrant predicated on stale evidence. He also asserts that the trial court erred by allowing the government to display unfairly prejudicial explicit images to the jury.

U.S. v. Hilton - This case relied on the use of computer forensics to locate child pornography on the appellee's hard drive.  The appellee was convicted of the knowing possession of child pornography.  He sought and was granted post-conviction relief, arguing that a definition of child pornography that was added to the Child Pornography Prevention Act violated the First Amendment by prohibiting some adult pornography — that appearing to be of children — and by virtue of vagueness and overbreadth. The district court agreed, holding that the CPPA's "appears to be" provision was overbroad and left unclear exactly what images were illegal. The district court dismissed the indictment. The United States appealed, and this court reversed and reinstated the indictment.

U.S. v. Ziegler - A case involving computer forensics in which the defendant accessed child pornography on a workplace computer.  The company monitored employee Internet use and determined by tracing the IP address that the child-pornographic websites had been accessed from the computer in the defendant's office.  The investigating agent allegedly told the company's IT administrator to make a copy of the defendant's hard drive before he was arrested.  The employees gained after-hours access to the defendant's office and made two copies of his hard drive without his knowledge.  The defendant moved to suppress the evidence from the hard drive on the grounds that the way it was accessed was an invasion of his privacy, but the motion was denied.  The defendant's contention on appeal was that the entry into his private office to search his workplace computer violated the Fourth Amendment and, as such, the evidence contained on the computer's hard drive must be suppressed.

U.S. v. Diaz - This case involved the use of computer forensics to determine that the defendant, a truck driver, had created a false bill of lading using a program on his computer that was discovered to have been deleted from the computer the day prior to his arrest.  The truck the defendant was operating was submitted to a search due to a discrepancy between the weight shown on the bill of lading and a weight scale ticket.  The investigating officer discovered over 3,300 pounds of marijuana in the truck. 

U.S. v. Phillips - The defendant's appeal of his conviction in this fraud case was based on the defendant's contention that a computer forensics expert should have been retained for him by the government.  In the motion here, the defendant alleges that his trial counsel was ineffective; defendant's motion was denied.

AVM Techology, LLC - Computer forensics expertise, trial testimony, Nationwide services

Main office: 8527 Mayland Drive, Ste. 107, Richmond VA 23294

(804) 396-4443