|
|
In This Issue:
 From the Bench: Courts Rely on Computer Forensic Experts
Court Finds Purposeful Downloading Sufficient to Establish Knowing Possession of Illegal Images
United States v. Luken, 2007 WL 2428656 (D.S.D. Aug. 21, 2007).
In a criminal prosecution for possession of child pornography, the defendant argued that he was not in possession of contraband materials because he did not possess forensic software necessary to access the illegal images in question. Denying the defendant's motions to suppress evidence and dismiss the indictment, the court found that evidence of the defendant's purposeful downloading and saving of the illegal images onto his computer hard drive in order to view them in thumbnail format was sufficient to establish knowing possession.
Court Addresses Numerous Discovery Issues and Orders Counsel to Solicit Bids from Computer Forensic Experts
Peskoff v. Faber, 2007 WL 2416119 (D.D.C. Aug. 27, 2007). After the defendant in this ongoing discovery dispute failed to appear at an evidentiary hearing, the court construed facts regarding his search for responsive documents on his computer against him and proceeded to other findings of fact. Next, considering the issue of whether a forensic examination should be undertaken to look for e-mails the defendant claimed were no longer in existence, the court applied the factors set forth in Fed. R. Civ. P. 26(b)(2)(C), including a revised version of subsection (iii) that U.S. Magistrate Judge Facciola noted will become effective on December 1, 2007. The magistrate judge explained that whether an additional search was actually warranted remained to be seen--especially with respect to e-mails deleted prior to the time the defendant had a duty to preserve them. However, after considering the Rule 26(b)(2)(C) factors, he found the case merited investigating the cost of a forensic examination and ordered counsel for both parties to seek bids from qualified computer forensic experts. Addressing arguments brought by defense counsel on behalf of an investment management entity now claiming it was a third-party, and not subject to preservation obligations, the court dismissed the assertions as untimely and unreasonable. Finally, the court ordered counsel for the plaintiff and the defendant to submit explanations of contradictory assertions each had made with respect to discovery issues.
State Not Required to Produce Copy of Hard Drive Allegedly Containing Child Pornography to Defendant
State v. Wells, 2007 WL 2769686 (Minn. Ct. App. Sept. 25, 2007). In this criminal case, the defendant moved to compel production of a forensic copy of his seized computer hard drive along with copies of all images of child pornography he allegedly downloaded. Taking note of persuasive precedent, the district court denied the motion but ordered the state to provide the defendant with an opportunity to review and inspect the computer images. The defendant maintained that the order violated his due process rights and requested appellate review. The district court framed the issue as a question and certified it to the Minnesota Court of Appeals. Finding that the district court did not abuse its discretion, the appellate court answered the certified question in the negative, concluding that the state is not compelled to produce copies of seized images and computer hard drives allegedly containing child pornography where the state provides a reasonable opportunity to view and inspect those materials at a law enforcement office.
The Brill Files: Kroll Ontrack Becomes One-Stop-Shop Through TrialGraphix Acquisition
Just a couple of weeks ago, Kroll Ontrack took an important step to provide our clients with even more legal technologies and services. We acquired TrialGraphix, a national litigation consulting firm that specializes in trial consulting and courtroom presentation services. TrialGraphix began in 1991 in Miami, Florida. In the past several years, demand for their services has grown, leading to additional offices in Atlanta, Chicago, Houston, Los Angeles, New York, Philadelphia and Washington D.C. I cannot be more excited about what the acquisition of this best-of-breed company means for Kroll Ontrack and, specifically, our computer forensic clients.
Here are just a few of the ways you will benefit:
Demonstrative Exhibits
Most people are visual learners. In fact, I hear people retain information presented in audio-visual presentations 650% more than information that is presented in an audio-only format. TrialGraphix has spent over a decade developing trial presentation software, graphics, computer animation and video services. With TrialGraphix we now have the capability to turn the information we’ve collected and forensically analyzed for you into effective trial exhibits, such as flow charts, graphs, maps, organizational charts, scene reconstruction, technical illustrations, text charts and timelines. As someone who loves to engage an audience, I personally cannot wait to supplement my own trial testimony with some of these great visuals.
Trial Strategy
As part of the Kroll Ontrack family, the TrialGraphix team can work with you to hone your case strategy. We can help you identify, refine and present powerful themes or establish settlement positions. Our trial consulting services include early case assessment; focus groups and jury research; mock trials; venue analysis; jury selection and voir dire; and post-trial interviews. This is really cutting-edge work that combines art and science. Take, for example, Real-Time technology for trial and jury consulting. Also known as dial testing, this method of collecting data gives you a preview of how jurors will perceive the most critical issues of your case. Truly fascinating!
Witness Preparation
The trial consultants at TrialGraphix have expertise in witness preparation, human behavior, persuasive communication and behavioral modification. They even offer training in relaxation techniques. As someone who has been regularly called as an expert witness, I know their trial consultants will be able to provide valuable insight and training to help me be an even more effective communicator. Imagine how this team can help all of your experts—especially those who may be technically brilliant, but who may not be as adept at communicating their expert opinions to a judge or jury.
As a computer forensic specialist, the addition of the TrialGraphix team to Kroll Ontrack is very exciting. I look forward to sharing with you future “Brill Files” reports that span the entire litigation continuum – from the moment data is collected all the way through to trial.
If you would like to explore the opportunity
of Alan Brill speaking at a conference you are supporting
or organizing, please contact Kristin Husom at 952 516 3781 or at khusom@krollontrack.com.
Technology You Should Know: Separating Fact from Fiction in Computer Forensic Investigations
Accurate or not, Hollywood has indelibly defined the characteristics of a computer forensic investigation in our imaginations. Whether it is a television crime drama or a blockbuster mystery movie, popular culture teaches that a good computer forensic investigation should always have an interesting set of facts that, when analyzed properly, will lead to a needle-in-the-haystack, smoking-gun clue.
When it comes to real-life, however, properly conducted computer forensic investigations are not as quick and easy as they may appear on television. Before you commence a computer forensic investigation, make sure everyone’s expectations are realistic. Here are a few pointers to keep in mind:
- Understand that the investigation may not reveal the information you were hoping to find.
Computer forensics is a science focused on interpreting facts. The facts themselves cannot be altered. When given a hard drive and asked to determine whether a particular user ever copied or e-mailed proprietary files, the examiner may look in several places such as remnant e-mail, link files pointing to access information, and deleted files. However, just because the examiner’s findings do not lead to the type of information the party requesting the examination expected to find does not mean the examiner is looking in the wrong place. The allegations may be false or inaccurate.
- Understand that 100% certainty is rarely attainable.
Computer forensic experts, like all scientists, are reluctant to conclude anything with absolute certainty. The facts are what they are, and often times can be subject to multiple interpretations. Be wary of someone purporting to be an expert who claims absolute certainty in their conclusions.
- Do not assume a proper investigation can be conducted if critical data has been deleted.
While deleted information is often recoverable, it is not realistic to assume that a computer forensic investigation can be performed as thoroughly or accurately if critical information is no longer readily accessible. Do not re-deploy computer hard drives that have not been properly imaged. There is no way to determine if a departing employee’s laptop may become the center of an investigation down the line, so the best practice is to employ procedures to image or copy the hard drive before it is wiped and re-deployed. It is important to do this immediately, before it is used by another employee, as the more the computer is used, the more the data on it is overwritten.
- Be sure your IT staff has the tools and resources to function as first-responders on the scene.
While it is usually not advisable to conduct an entire investigation without the assistance of a qualified third-party computer forensic expert, internal IT staff is often critical to ensuring that information is properly preserved for further investigation. If you seek to perform the imaging in-house, be sure the IT team has the tools to properly create mirror images of any at-issue hard drives, as examinations should always be performed on images, not on the actual hard drives themselves. Precautions should also be taken to minimize the risk of accidentally overwriting data during the imaging. Hardware and software write blockers allow for reading only, and do not allow data to be transferred back to the original hard drive. Whether you perform the mirror imaging in-house or outsource this function to an expert, be sure whoever is doing it can verify the accuracy of the image by providing a hash value for comparison to the original.
Finally, keep in mind that consulting a skilled computer forensic investigator early on in the process will increase the likelihood of a successful recovery, analysis and investigation. Keeping your expectations in check, following these simple pointers and knowing when to ask for help will ensure the next computer forensic investigation you undertake leads to accurate information and that you will be satisfied with the results.
NEWS & EVENTS
Kroll Acquires TrialGraphix
Kroll recently announced that it acquired TrialGraphix®, a best-of-breed provider of trial consulting and presentation services headquartered in Miami, Florida. TrialGraphix will operate as part of the Legal Technology business of Kroll Ontrack. The acquisition expands Kroll’s litigation service offering to include trial graphics, courtroom presentation technologies and jury consulting services. Ultimately, this enables law firms and corporations to engage one expert for their litigation consulting and technology needs from pre-litigation preparedness, through discovery and trial. This combination eliminates the need to select multiple experts or to transfer evidentiary materials between service providers throughout the litigation timeline, which advances Kroll’s objective to provide comprehensive services to the litigation community. Documents that are preserved and collected before litigation, can now be filtered, processed, reviewed and produced for discovery, then seamlessly presented at trial. More information about TrialGraphix® can be accessed at: http://www.trialgraphix.com/
Meet our representatives at the following
events:
Visit www.krollontrack.com/upcomingevents for more information on these events and others.
Back To Top
We Request Your Input
Our legal consultants, project managers, and technology experts strive to stay on top of e-discovery law. If you are aware of any additional local court rules or new cases in this area of the law, please contact us by writing to mlange@krollontrack.com.
This newsletter is written by Michele C.S. Lange, Kroll Ontrack Legal Technologies Director, with assistance from Joni Heikes, a Kroll Ontrack staff attorney. Ms. Lange has published numerous articles and speaks regularly on the topics of e-discovery, computer forensics, and technology’s role in the law. She can be contacted by writing to mlange@krollontrack.com.
For more information about e-discovery and computer forensics services, contact Kroll Ontrack at 800 347 6105 or www.krollontrack.com.
|
 |
