Shaffer & Engle Personal attention. Compassionate response. Fast Results.
Shaffer & Engle Personal attention. Compassionate response. Fast Results.

Use of a Computer Forensic Expert in Child Pornography Cases

National Association of Distinguished Counsel | Nation's Top One Percent 2017 | NADC
Partner With A Trusted Legal Ally, Call:
717-827-4074

Should we or shouldn't we retain an expert?

Image result for law books and gavel

By Attorney Elisabeth K.H. Pasqualini, Megan's Law Attorney, Harrisburg, PA

One of the first things that I discuss with a client is whether or not we should retain our own computer expert.  The prosecution certainly has theirs.  The officer in charge of the investigation may not be "tech savvy" but there is a team of forensic computer examiners working for the Commonwealth.

Why is an expert an invaluable tool?

  • Understanding "file-sharing"- An expert can help the defense understand and provide expert assistance into how file-sharing and online pornography sites operate.  Sites such as LimeWire and FrostWire are typical sites for sharing such as music, pictures, videos and pornography.  Large parts are legal.  However, sometimes the items found on such sites are not.  This is important to understanding the accessibility of the shared data and how it's distributed.
  • Importance of File-Naming Conventions- The formating of the information that has been downloaded onto a client computer is another important component to a defense.  Sometimes, files are downloaded by numbers rather than by images.  A searcher may enter a term "teen sluts" and be guided to hundreds of images that appear by number.  Many clients will download the entire file for later viewing, not knowing that some of those in the file are illegal.  A forensic comptuer expert may be able to determine that the image in question was never viewed.
  • File Reconstruction- The prosecution's forensic file discovery may utilize programs such as EnCase, FTK Imager and Cellebrite.  Your own expert may assist in deconstructing the prosecution's case by exposing strengths and weaknesses by determining operator error in the process of extracting and identifying images.
  • Unallocated Space- Files that are "deleted" are never actually deleted.  "Deleted" items may end up in an area known as "unallocated space."  A client may wrongly believe that they have deleted a child pornographic image, with all good intentions, only to have the image stored in "file slack."
  • Unintentional Downloads- Most computer users are not aware that images are regularly downloaded onto their systems without their knowledge.  In the world of online pornography one may "daisy chain" from one site to the next from a primary site.  As a user wanders from page to page, they may accidentally be collecting illegal images on their computer hard drive.

Experts are usually and invaluable resource to assist the team in understanding how the images were collected.  It is also an important tool to analyze the prosecution's case and determine any weaknesses.  They can provide insights into possible defenses as well as mitigating factors that a defense attorney can use to prepare her case.

No Comments

Leave a comment
Comment Information