Let them eat Cake in Computer Forensics? Maybe not this time.

By at 16 December, 2009, 11:38 am

Law enforcement agencies around the country use Encase from Guidance Software to forensically image computer disks in investigations and prosecutions. This means that defense experts need to own this $3,000+ program rather than a less expensive alternative. However, in Washington State it appears that is no longer the case.

The December 15, 2009 Law Technology News Daily Alert links to a post on the CYB3RCRIM3 blog Ghost v. EnCase which details the ruling in State v. Dingman, 149 Wash.App. 648, 202 P.3d 388 (Washington Court of Appeals 2009). The defense had requested that its forensics expert be provided a copy of the hard drive from t he defendant's computer seized by authorities. The prosecution provided a copy made from their EnCase program. The defense requested that they be provided an image created using Ghost software for which the prosecution held a license. It seems that neither the defense lawyer or expert owned a copy of the $3,000+ EnCase software and were concerned that its search capabilities would be biased towards law enforcement. Instead, the defense asked that they be provided an image made by Ghost software for which the State held a license as well. Defense argued:

`The State has translated the computers into Farsi, a foreign language that we don't speak, and asked us to take Farsi because that's what they decided to do and it was convenient and maybe very wise on their part. Well, we don't want it in their language, your Honor. We want the discovery as it existed in Mr. Dingman's computers and as it still exists in Mr. Dingman's computers.’

He added that the State already had an exact copy of the files . . . so it could easily detect if either Ghost or the age of the computers somehow altered the evidence.

This seems to be a reasonable request, but the prosecution decided to take a page from "Let them eat cake" crowd and countered that it did

`not need to conform its investigation . . . to the whims . . . of the defense.’ . . . It added it had never had a problem with providing the copies of the files — in EnCase format – to the defense. . . .

Another way to look at this response is the defense was being told to 'go pound sand.' The trial cout agreed with the prosecution and the Defendant was convicted on a number of accounts.

On appeal, the Appellate court turned to a federal decision from United States v. Flinn, 521 F.Supp.2d 1097, 1101 (U.S. District Court for the Eastern District of California 2007) which had held that a defense expert should be able "utilize his or her hardware or software."

The Appellate court also reviewed Washington State criminal discovery statutes and at the end of the day held that the prosecution hadn't complied with the requirements of discovery and reversed the trial court's decision and remanded for a new trial.

The lesson here is that you need to review the theory of discovery and the requirements of your states discovery rules. Just because this is the way you always have done something, such as turn over disk images in EnCase, doesn't mean that it is the "only" way and you should be ready for alternatives.

Let them eat cake? Not this time.

Categories : E-Discovery | Legal Technology


No comments yet.

Leave a comment