I have been involved with so many criminal sex offense cases…I had something happen to me during a deposition a few weeks back that surprised me (which is hard to do). I had analyzed a hard drive on which the client was accused of possessing contraband pornography. The other side had a somewhat green expert who reported and swore under oath that there were dozens of contraband pictures on this hard drive and that he could PROVE who put them there (OK, I guess he was there during the event). Well, when I reviewed it I found maybe 2 or 3 that were definite and 10 or 12 that were possibly borderline. They were all in Browser cache amongst hundreds of other legal porn files, which means they weren’t purposefully saved by the user or moved anywhere for safekeeping, but were put there by the Operating System during browsing, most likely by pop-ups or redirects.

To make a long story longer the opposing attorney actually asked me…(paraphrasing) Mr. Odenthal, do you think that maybe after all these years of viewing this type of illegal pornography that you have become somewhat immune to it and don’t think it’s illegal when it really is? Hmmm…me thinks it’s probably the other way around. I think the attorney was just so flustered by my professionalism and calm, accurate responses that it appeared I was unaffected by the material (which I said I did not find anyway). This is absolutely not the case and in earlier times I had wished I could have had a couple psych sessions here and there just to help me learn to be a little more thick-skinned about it. I have since learned how to handle it on my own. It’s just a career and you have to take the good with the bad. Sort of like a plumber, most of whose work is clean and easy, but sometimes has to fix a clogged toilet!

But on to the topic of the day, the Sex Offender Registry. In my humble opinion this is the most heinous, life altering, Big Brother ruining your life, unbeleivably bad government program that has ever been conveived in modern days. I know that MANY people will disagree with me on this because “Oh my god I need to know who in my neighborhood is a sex offender so I can keep my kids safe!” First of all, most people don’t know how to look this information up or just don’t do it. Secondly, if they do find a sex offender in their neighborhood what do they do then? THEY TRY TO RUN THEM OUT OF TOWN ON A RAIL.”

Now let’s be clear about my opinion here. If a sex offender is violent, a rapist, a repeater, or has killed  or harmed a child, I think they should be put away, period. But what about the smuck who was caught downloading child porn on the internet either purposefully or accidentally, or the 18 year old with a 16 year old girlfriend, or more recently the case where the high school kids were sending naked pictures of girls to everyone in school on their cell phones. Do we really want to put these people on a Sex Offender Registry with the rest of the really bad offenders? Most of the time it’s a lifetime registration.

I truly believe that this is the witch hunt of the 21st century. What I really think would be good information for me to know is who in my neighborhood is a murderer, a burglar or has committed a home invasion? Why is it that once a murderer or burglar gets out of jail everyone says he has done his time and paid for his crime? Shouldn’t there be a Murderer Registry? A Burglar Registry? A Home Invasion Registry? A Drunk Driver Registry? Is my wife’s life and safety any less important than your child’s? Well, maybe yes a little due to a child’s innocence and helplessness but let’s be realistic. We all protect our kids pretty well these days.

Not only is the Sex Offender Registry unusually cruel punishment to the non-violent offenders, but I must add here that the sentencing for SOME of these crimes is unbelievably harsh. Do you know that in some states there is a mandatory minimum of several years for each contraband picture that is found on a computer? Although the Court may have the discretion to run the sentences concurrently, they usually don’t. So if there are 20 contraband pictures on your computer and you get caught with them, chances are that you will go to state prison for 40-60 years for looking at pictures you’re not supposed to look at or possess that you got off of the internet.

A few words of advice. Don’t ever have Peer to Peer (P2P) programs like Limewire, Kazaa, Bearshare, Shareaza or ANY of the downloading programs on your computer, EVER! Get rid of them if you do. If you must look at porn, buy a magazine. Know what your kids and everyone else who has access to your computer is doing with that thing, because if someone else puts illegal material on your computer, it’s still your computer. Besides that, monitor your kid’s activities closely. If you want to protect them, prevention is still the best way.

Finally, this is probably a pretty controversial post and it may be used against me some day in court. However, these are my opinions being published on my blog. As I have said time and again, I find illegal images of children disgusting and abusive. But let’s think about this. Isn’t this something akin to the drug wars that have been raging against our society for decades? We put away all of the druggies but can’t stop the real offenders, the manufacturers of the drugs. Let’s stop going after any little guy that has a few illegal porn pics on his computers. Go after the real creeps that are actually abusing and violating these children.

Well, here I am in Georgetown, TX about 20 miles north of Austin. I selected this area for a lot of reasons, great weather, beautiful city nearby, on the outskirts and near the hill country. The biggest reason was that it is in the middle of the triangle of big cities like Dallas/Fort Worth, Houston and San Antonio. Not much more area than I covered in Wisconsin. I have been here since 7/08. Before I moved I sent out more than 10,000 introductory brochures to attorneys that were in Bar Sections likely to need my services. No response…

As I write this today, I am definitely happy we made the move, however still, all of my work is still coming from Wisconsin where I maintain my original computer forensics business. So off I go, at least once a month, to Wisconsin to work on a cluster of cases needing my attention.

I have started up several businesses in my life and I know how it works. 2 to 3 years to really get established, networking, direct mail, speaking engagements, etc. However here in South Central Texas I am not getting the response I usually expect to get by this time. All of my attempts to get speaking engagements have been thwarted or ignored. Calls and emails go unanswered. My accounts for Texas are empty.

I know that there are more Forensic Experts here, however, my niche practice is so narrow, mostly criminal defense of possession of child pornography and associated matters having to do with computers, that it boggles me. I know from experience and research that most Forensic Experts don’t want to do these types of cases, or can’t because of other affilitations, and also even though there are more Private Investigators here that do Computer Forensics it’s more of an additional service to 5 or 6 other services that have nothing to do with Forensics.

Computer Forensics is all I have done for the past 12 years, and although business is still good for me in other states, I really would like to get on the train ride here! Hmmmm…. I think I need to go national.

With all of the problems associated with the ongoing economic crisis, 2009 should be a big year for computer forensics.  Analysts across the country and around the world will truly have their hands full when it comes to case loads related to eDiscovery.  More than ever before, electronic evidence will need to be located and properly catalogued on an unprecedented scale.

Investigations by the government will increase over 2009 as many more lawsuits related to collapsing companies, banks, and venture capital funds consumes more court time.  High profile scandals and bankruptcies will be put under the microscope as well, while analysts do their best to help figure out what went wrong—and when it actually started to do so.  This can be a tricky task indeed, as the systems used by most companies are proprietary in nature and therefore unique from corporation to corporation.

Corporate America will also be pushing to standardize computer information systems to give more transparency for audits and compliance when it comes to eDiscovery.  Accountability will certainly be a hot-button issue as more information comes to light.  Of course this will make things easier for analysts in the future, but does nothing for the slew of case from 2008 that are still pending awaiting electronic evidence.

With the many cases and challenges that are forthcoming, analysts will need to cross their T’s and dot their I’s, because when it comes to computer forensic work, heavy scrutiny will be placed on the analysts themselves.  The reason for this is that a proper chain of evidence and documentation must be followed to letter for electronic evidence to hold up in court.

Because the level of technological ability of the analyst is far greater than that of the general public, care must be taken when handling evidence.  Anything less creates reasonable doubt about the veracity of said evidence, which could truly make or break a case in this day and age. 

Fortunately, because of all of these obstacles much attention will be placed upon data mapping and storage by major companies and financial institutions for the future.  Whereas private customer data will not be accessible, anything else related to the policies and procedures of a business under investigation would ultimately end up being fair game, depending upon the scope of the case.

By-line:

This post was contributed by Holly McCarthy, who writes on the subject of forensic science careers. She invites your feedback at hollymccarthy12 at gmail dot com

It seems that I have been analyzing hard drives for a long time; well at least ten years now. Depending on the case I have two major tools that I use. Experienced Analysts can probably guess what they are. Lately I have taken some courses using Linux software tools for Acquisition and Analysis. I like the Acquisition capabilities, but the Analysis part seems to put me off. It just isn’t as easy and all-encompassing as the Windows-based tools. The reporting seems lacking as well.

I was talking to a colleague the other day who told me that a Linux product let him boot up a suspect machine just as the user would see it without making writes to the evidence drive. That is something I need to research, because for me I was thinking the only way to do that would be a $1200.00 Shadow device. I don’t like to spend money on software or tools that I may not need or would seldom need, so I was waiting for the time to come when I would need this type of tool and then I would buy it. The same goes for cell phone forensics. I might get 2 calls a month for this service and I always refer it to someone else. Why? because the ROI isn’t worth it at that pace.

Hardware, especially computer Analyst Stations, are the same story. I make my own out of off the shelf computers. Add the necessary write blockers, memory, specialty cards, bridges and such and there we go! Spending 7 or 8 thousand on a “do it all” machine just isn’t worth it to me. It’s the reliability of the forensic software and the expertise of the Analyst that in my opinion really counts. I refuse to take cases I know I can’t handle or use software, hardware or other tools that I have not thoroughly tested in my lab.

I wonder. Is the poor economy causing people to stay home and look for other ways to entertain themselves? I hope this isn’t the case, but lately, cases have been pouring in like rain through a leaky roof. All kinds of different cases. Unfortunately for my business, most of the cases are through Public Defenders (indigent defense) possibly because people can’t afford private lawyers. Any lawyers out there that can confirm this? While we’re at it, what is the consensus of the lawyers out there; would you rather have a Computer Forensic Analyst that has a good reputation but may not be close by or an Analyst that is close by geographically? Of course one choice is an Analyst that is good and close, but don’t use that choice in a response!

Of course I don’t mind doing Public Defender cases. I feel I am giving back to the community in a way. However, the private cases pay much better. One thing I can say is that the Private Detective Industry, and especially the Computer Forensic practice is unique. No matter what the state of the economy, business is almost always good. Hmmm…

Computer Forensic Experts can assist in Criminal, Civil Litigation and domestic cases. In all of these cases, an experienced Expert has usually seen, in general, the same type of case over and again. The Expert sees the case in a different way than the attorney as the Expert is an objective evaluator of the facts of the case, whereas the attorney is more of an advocate for his client, as it should be. When the attorney has an objective element working his case, he gets what he needs to know to plan the best course for his client. Should the client fight the charges, lawsuit, child custody decree? Or should he plea, settle or let the child custody decision stand? Is it worth the risk, time or money for the client to do what he thinks he wants to do? These are the attorney’s choices to advise his client. Because the Expert has such insight into the depth of the facts of the case that the attorney may not fully understand he/she may therefore have trouble relating it not only to the client but to the court or jury. Even though the Expert may testify, the attorney needs to know the right questions to ask and additionally, needs to know how to cross examine the opposing Expert. I have had successes from merely submitting affidavits in criminal defense cases because the opposing Expert’s conclusions were faulty. Computers are involved in so many cases now, that the trial lawyer must have access to this most important resource.

Very early this year I was engaged by a State Public Defender in a child porn case. Although the Adam Walsh Act really applies to Federal cases it is trickling down to the state level. In a motion hearing attempting to get the forensic copy of the hard drive, the DA was adamant that I not have it, citing the Federal Act. I heard that the state AG distributed a memo that anytime a motion is made to get discovery of this contraband is made, if the court allows it the DA should immediately appeal it. Well the court decided that they would give me the hard drive copy but would not protect me from prosecution under the statute, which has no exemption for possession of this type of contraband. Under these circumstances I told the Public Defender attorney that I couldn’t take the case. I had been telling the SPD for over a year that they were going to have to be the ones to fight this state problem. Finally, they appear to be doing just that. The SPD attorney I declined to assist as an expert has had the case on appeal for almost 8 months now. Don’t know how this will turn out, but now I hear that at least 2 more SPD attorneys are going down the same road…I have a load of arguments for motions on this topic.

Computer Forensics is evolving as we speak. Although the technologies, processes and protocols are much the same, the Legal Issues surrounding the practice, methodologies, perceptions of findings and presentation of evidence in court are changing rapidly.

I do a lot of Criminal Defense work in my practice, in particular, the defense of possession of child pornography on computers. While this may turn many of you off at first, let me say before you go that this is America! The constitution of this great land was set up to help protect us against helter skelter actions of the government, ie; it is better to let 10 guilty people go free than to put one innocent in jail.

I did not specifically choose to do primarily Criminal Defense, in fact I do a good share of civil and domestics on both sides, plaintiff and defense. If you are a Computer Forensic Anlayst, then you know that you must remain at all times objective.

For those whom are still reading this, congratulations! You are an objective person that is interested in the truthful fact finding mission of the judicial system.

My first entry to this blog is one that I feel has uprooted the consititutional right of the defense in a criminal matter to examine the evidence against you in a fair and equal manner. This is an excerpt from the Adam Walsh Act (§ 3509(m)) which was passed on July 27, 2006 -

(1) In any criminal proceeding, any property or material that constitutes child pornography shall remain in the care, custody, and control of either the Government or the court.

(2) (A) Notwithstanding Rule 16 of the Federal Rules of Criminal Procedure, a court shall deny, in any criminal proceeding, any request by the defendant to copy, photograph, duplicate, or otherwise reproduce any property or material that constitutes child pornography, so long as the Government makes the property reasonably available to the defendant.

(B) For purposes of subparagraph (A), property or material shall be deemed to be reasonably available to the defendant if the Government provides ample opportunity for inspection, viewing, and examination at a Government facility of the property or material by the defendant, his or her attorney, and any individual the defendant may seek to qualify to furnish expert testimony at trial.

In effect, § 3509(m) creates an uneven playing field by forcing defense attorneys to prepare for trial with highly restricted access to material evidence while the government experts have complete, unfettered access to this evidence. Section 3509(m) directs trial judges to disregard discovery rules and to define the parameters of what constitutes “reasonably available” evidence.

I have first hand knowledge of the ramifications of this act. I used to be able to get the computer evidence, along with a court protective order, and examine and analyze the evidence at will until the case was complete. Now, when I get one of these cases, I must almost always go to the Law Enforcement Agency in control of the evidence and analyze it there. Many times, because they all can make up their own rules about the methodology of the exam, I am unable to use my own equipment and unable to take with me file listings or other data, not including graphic data. Several months later when it comes time for trial, I must rely on my notes, reports and memory, when the prosecutor’s expert can simply revisit his analysis on the actual evidence.

If you are interested in reading the text of this act simply google “Adam Walsh Act” and while you are at it you may google “Rule 16 of the Federal Rules of Criminal Procedure” for comparison.

Let me be clear, I am not for or against child pornography, I am neutral in this case. I can tell you this from personal experience. The Adam Walsh Act began on a Federal level and is now trickling down to the State level. Pretty soon, if you are charged with possession of child porn, you will have no defense at all.