Computer Forensics Docket Sheet

The defendant appealed convictions relating to pandering sexually oriented matter involving minors. The defendant's son testified that he called the police after finding pornographic images of minors in the recycle bin of his computer, which the defendant had previously used. During a forensics analysis of the computer, a computer-forensics expert mirror-imaged the hard drive. Before returning the computer, the expert overwrote the hard drive, erasing all data on the drive. At trial, the state presented the mirror-image copy as evidence. The expert testified that it was standard protocol not to run tests on the original hard drive so as to prevent corrupting the evidence and stated that the mirror image was an exact copy of the original hard drive. The expert further noted that he had wiped the hard drive because it was corrupted, and repeatedly accessing and testing the drive would have rendered it useless. On appeal, the defendant argued that he was denied an opportunity to examine the original hard drive to see whether it contained exculpatory evidence. The court declared that state evidentiary rules permit admission of duplicates and noted that the expert had testified that the copy was an exact copy of the original hard drive. The court upheld the convictions, finding that the defendant had failed to specifically argue what type of exculpatory evidence may have been lost during the copying procedure and the original was not destroyed in bad faith. State v. Morris, 2005 WL 356801 (Ohio Ct. App. Feb. 16, 2005).

In prosecuting charges against the defendant for transporting minors for illegal sexual activity, the government claimed that the defendant had used America Online instant-messaging software in an attempt to engage in sexual conduct with “Julie,” an undercover government agent posing as a minor. The government sought to admit two transcripts of AOL Internet communications between the defendant and two other undercover agents who had sent and received instant messages from the defendant. The defendant argued that the transcripts should not be admitted because they were irrelevant, unfairly prejudicial and potentially confusing to the jury. The court determined that one of the chat transcripts was admissible because it was sufficiently similar to the charged conduct, permitting a reasonable jury to infer that the defendant was motivated by a sexual intent in his interactions with “Julie.” The court found that the other chat was not admissible because it was not sufficiently relevant due to its nonsexual subject matter. United States v. Brand, 2005 WL 77055 (S.D.N.Y. Jan 12, 2005).

Computer Forensics Docket Sheet was written by Michele C.S. Lange, a member of this newsletter's Board of Editors, and a staff attorney with Kroll Ontrack, with assistance from Charity Delich, a Kroll Ontrack law clerk. Lange has published numerous articles and speaks regularly on the topics of electronic discovery, computer forensics and technology's role in the law. Information in these summaries is taken from the Kroll Ontrack monthly E-Discovery Case Law Update and Computer Forensics newsletters, which may be accessed at http://www.krollontrack.com/. Lange can be reached at [email protected].

Court Finds Computer Mirror
Image Properly Admitted