Computer Forensic in Criminal Cases

Computer Forensic in Criminal Cases

The recent increase in crimes involving the use of computer has attracted interest from techno savvy groups who have developed a system of dealing with those cases. The use of computer forensic is helping to solve high profile criminal cases in courts through analyzing of available, hidden, or deleted with the view of providing evidence for prosecution. Computer forensic is applied in many areas that involve the use of computer to perform a malicious work. This paper analyzes the application of computer forensic in the recent case of child pornography involving United States v. Tucker. The paper explores the positive and negative investigative and forensic techniques used in the application of computer forensic in this case.

Jeffrey Tucker was suspected of child pornography but prosecution could not bring charges against him because it lacked evidence. Tucker himself was confident that no evidence could be found against him since he deleted all the information from his computer after use. However, the prosecution team decided to engage the services of computer forensic experts and thus Tucker was stalked without his knowledge. His internet service provider served with a subpoena, revealed all information regarding Tucker’s contact on the internet the forensic expert. Finally, the prosecution was able to press charges against Tucker after seizing his computer and retrieving deleted information from the hard drive (Nelson, 2008).

Forensic Techniques Used

In the recent case of United States v. Tucker, Jeffrey Tucker was found guilty of possessing child pornography. In this case computer forensic was used to retrieve deleted information that was crucial in the investigation of the case. The forensic techniques used involved retrieval of deleted information that resided on the cache files that were stored on the hard drive. Such cache files had been stored on the hard drive during Tucker’s visit to various child pornography websites. They were recovered using a computer forensic technique of mirroring. This action was facilitated by the creation of log files that revealed the IP addresses the previously connected person to the websites had used.

In this case, it was easily to prosecute Tucker for child pornography because the ISP had been issued with a subpoena to give information related to his account. Similarly, the records of the websites that Tucker had visited had been seized on the server and what forensic experts did with Tucker’s computer was simply to compare the information that they already had about Tuckers conduct on the internet (Nelson, 2008).

Additionally, the forensic experts utilized the hash value technique that was received from the Internet Protocol (IP) addresses that were reflected on Tucker’s internet traffic. A hash value is like a fingerprint or DNA in that it is unique to particular IP addresses and cannot resemble any other ( Recupero, 2008). The hashes values seize from Tucker’s internet traffic were compared to contraband hash values.  According to forensic findings, the genuineness of some hash values could not be determined even though it was clear that some matched with those that were previously classified as emerging from child pornography sites. Contraband hash values belong to determined sites that contain that information deemed harmful or disturbing.

Positive and Negative Outcomes of Computer Forensic

On the positive side the computer forensic revealed evidences that enabled prosecutors to file charges against Tucker. It was possible to prove that indeed Tucker was involved in child pornography through the retrieval of deleted files and visited sites without any reasonable doubt on the part of the accused. Through creation of log files, the websites that Tucker had visited many years ago were accessed. However, the forensic investigation infringed on the privacy of Tucker by accessing his private information without his consent. Equally, the ISP was coerced to give information about their customer without customers consent. 

How the Case Could Change with New Investigation Techniques

The ISP would not be required to give personal information belonging to Tucker since phishing techniques could be used to stalk Tucker’s online activities. This could be possible only with his IP address. Even more important is that Tucker could easily appeal in this case if the forensic experts did not use mechanisms to protect themselves from the accusation of Trojan attack to the sites that Tucker had previously visited. Trojan attack is a malware that brings unnecessary information to ones website of computer to provide false evidence.

Conclusion

The above discussion has explored some of the forensic techniques used in criminal investigation. However, the paper has found that forensic techniques are not foolproof and thus challenging if haphazardly presented in a court of law as valid evidences for prosecution.