Introduction
Your computer will betray you. This is a lesson that many CEOs, criminals, politicians, and ordinary citizens have learned the hard way. You are leaving a trail, albeit a digital one; itâs a trail nonetheless. Like a coating of fresh snow, these 1s and 0s capture our âfootprintsâ as we go about our daily life.
Cell phone records, ATM transactions, web searches, e-mails, and text messages are a few of the footprints we leave. As a society, our heavy use of technology means that we are literally drowning in electronically stored information. And the tide keeps rolling in. Donât believe me? Check out these numbers from the research company IDC:
âą The digital universe (all the digital information in the world) will reach 1.2 million petabytes in 2010. Thatâs up by 62% from 2009.
If you canât get your head around a petabyte, maybe this will help:
âOne petabyte is equal to: 20 million, four-drawer filing cabinets filled with text or 13.3 years of HD-TV videoâ (Mozy, 2009).
The impact of our growing digital dependence is being felt in many domains, not the least of which is the legal system. Everyday, digital evidence is finding its way into the worldâs courts. This is definitely not your fatherâs litigation. Gone are the days when records were strictly paper. This new form of evidence presents some very significant challenges to our legal system. Digital evidence is considerably different from paper documents and canât be handled in the same way. Change, therefore, is inevitable. But the legal system doesnât turn on a dime. In fact, itâs about as nimble as the Titanic. Itâs struggling now to catch up with the blinding speed of technology.
Criminal, civil, and administrative proceedings often focus on digital evidence, which is foreign to many of the key players, including attorneys and judges. We all know folks who donât check their own e-mail or even know how to surf the Internet. Some lawyers, judges, businesspeople, and cops fit squarely into that category as well. Unfortunately for those people, this blissful ignorance is no longer an option.
Where law-abiding society goes, the bad guys will be very close behind (if not slightly ahead). They have joined us on our laptops, cell phones, iPads, and the Internet. Criminals will always follow the money and leverage any tools, including technology, that can aid in the commission of their crimes.
Although forensic science has been around for years, digital forensics is still in its infancy. Itâs still finding its place among the other more established forensic disciplines, such as DNA and toxicology. As a discipline, it is where DNA was many years ago. Standards and best practices are still being developed.
Digital forensics canât be done without getting under the hood and getting your hands dirty, so to speak. It all starts with the 1s and 0s. This binary language underpins not only the function of the computer but how it stores data as well. We need to understand how these 1s and 0s are converted into the text, images, and videos we routinely consume and produce on our computers.
What is digital forensics?
There are many ways to define digital forensics. In Forensic Magazine, Ken Zatyko defined digital forensics this way:
âThe application of computer science and investigative procedures for a legal purpose involving the analysis of digital evidence after proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, reporting, and possible expert presentationâ (Zatyko, 2007).
Digital forensics encompasses much more than just laptop and desktop computers. Mobile devices, networks, and âcloudâ systems are very much within the scope of the discipline. It also includes the analysis of images, videos, and audio (in both analog and digital format). The focus of this kind of analysis is generally authenticity, comparison, and enhancement.
Uses of digital forensics
Digital forensics can be used in a variety of settings, including criminal investigations, civil litigation, intelligence, and administrative matters.
Criminal investigations
When you mention digital forensics in the context of a criminal investigation, people tend to think first in terms of child pornography and identity theft. Although those investigations certainly focus on digital evidence, they are by no means the only two. In todayâs digital world, electronic evidence can be found in almost any criminal investigation. Homicide, sexual assault, robbery, and burglary are just a few of the many examples of âanalogâ crimes that can leave digital evidence.
One of the major struggles in law enforcement is to change the paradigm of the police and get them to think of and seek out digital evidence. Everyday digital devices such as cell phones and gaming consoles can hold a treasure trove of evidence. Unfortunately, none of that evidence will ever see a courtroom if itâs not first recognized and collected. As time moves on and our law enforcement agencies are replenished with âyounger blood,â this will become less and less of a problem.
Bind, torture, kill
The case of Dennis Rader, better known as the BTK killer, is a great example of the critical role digital forensics can play in a criminal investigation. This case had national attention and, thanks to digital forensics, was solved 30 years later after it occurred. To all who knew him before his arrest, Dennis Rader was a family man, church member, and dedicated public servant. What they didnât know was that he was also an accomplished serial killer. Dennis Rader, known as Bind, Torture, Kill (BTK), murdered ten people in Kansas from 1974 to 1991. Rader managed to avoid capture for more than 30 years until technology betrayed him.
After years of silence, Rader sent a letter to the Wichita Eagle newspaper declaring that he was responsible for the 1986 killing of a young mother. The letter was received by the Eagle on March 19, 2004. After conferring with the FBIâs Behavioral Analysis Unit, the police decided to attempt to communicate with BTK through the media.
In January 2005, Rader left a note for police, hidden in a cereal box in the back of a pickup truck belonging to a Home Depot employee. In the note, he said:
âCan I communicate with Floppy and not be traced to a computer. Be honest. Under Miscellaneous Section, 494, (Rex, it will be OK), run it for a few days in case Iâm out of town-etc. I will try a floppy for a test run some time in the near future-February or March.â
The police did the only thing they could. They lied. As directed, they responded (via an ad in the Eagle) on January 28. The ad read: âRex, it will be ok, Contact me PO Box 1st four ref. numbers at 67202.â
On February 16, a manila envelope arrived at KSAS-TV, the Fox affiliate in Wichita. Inside was a purple floppy disc from BTK. The disc contained a file named âTest A.rtf.â (The .rtf extension stands for âRich Text Formatâ). A forensic exam of the file struck gold. The fileâs metadata (the data about the data) gave investigators the leads they had been waiting more than 30 years to find. In addition to the âDate Createdâ (Thursday, February 10, 2005 6:05:34 PM) and the âDate Modifiedâ (Monday, February 14, 2005 2:47:44 PM) were the âTitleâ (Christ Lutheran Church) and âLast Saved By:â (Dennis).
Armed with this information, investigators quickly logged on to the Christ Lutheran Church website. There they found that Dennis Rader was the president of the churchâs Congregation Council. The noose was tightening, but it wasnât tight enough. Investigators turned to DNA to make the case airtight. Detectives obtained a DNA sample from Raderâs daughter and compared it to DNA from BTK. The results proved that BTK was her father. On February 25, three days after the DNA sample arrived at the lab, Rader was arrested, sealing the fate of BTK. He is currently serving ten consecutive life sentences (Wichita Eagle).
Civil litigation
The use of digital forensics in civil cases is big business. In 2011, the estimated total worth of the electronic discovery market was somewhere north of (780 million (Global EDD Group). As part of a process known as electronic discovery (eDiscovery), digital forensics has become a major component of much high-dollar litigation. eDiscovery ârefers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal caseâ (TechTarget, 2005).
In a civil case, both parties are generally entitled to examine the evidence that wil...