Criminal Justice Section
Criminal Justice Magazine
Volume 19 Number 4
GETTING TO KNOW AND LOVE ELECTRONIC EVIDENCE
A NONTECHNICAL BRIEFING FOR THE LAWYER WHO THINKS A
HARD DRIVE IS RELATED TO A LITTLE WHITE BALL HIT WITH A CLUB
By Richard A. Ginkowski
Richard A. Ginkowski, is a state prosecutor in Kenosha, Wisconsin, and has been using, building, swearing by (and swearing at) computers for 31 years. He is also a current member and former chair of the editorial board of Criminal Justice magazine.
Regardless of whether we prosecute or defend criminal cases, the materials we obtained and used in the past have usually been fairly constant and relatively low-tech. For example, in a battery or homicide case we might see:
• copies of police reports, witness statements and confessions, medical records, laboratory reports, and criminal histories;
• photographs (including occasional x-rays);
• audiotapes of 911 calls, witness statements, and confessions;
• videotapes of crime scene evidence gathering and, occasionally, confessions.
In these cases our biggest challenge to date has usually been whether the photocopies are readable. Most of us have audiocassette recorders and VCRs that we can use to listen to or view tapes. In short, we’ve typically dealt with “hard copy” evidence and fairly low-tech electronic evidence.
For better or worse, the move toward instant communication and the “paperless office” means that technology has forever changed how we’ll receive, handle, and use discovery:
• The photographs you received as prints on photographic paper may now be digital images on a CD-ROM.
• What was once on a videocassette may now be on a DVD.
• The “body wire” recordings in a drug case or 911 calls may also now also be stored on optical discs.
• Police reports may be transmitted electronically.
• X-rays may be stored electronic images.
• E-mails may have taken the place of statements from witnesses or opinions by experts.
• The police may have seized data from a computer—perhaps even the entire computer.
The possibilities are as endless as our creativity and technological advancements will permit. Our challenge as criminal law practitioners is how we’ll obtain, store, examine, and use this evidence.
Our civil litigation colleagues are far ahead of the curve in terms of discovering and using electronic evidence. Because the scope of their discovery reaches far beyond that in a typical criminal case, their experiences are instructive but not necessarily comparable. (By the same token, anyone who has had an Internet pornography case probably has had a baptism by fire into the realm of electronic evidence.) Nonetheless, an Internet search will turn up dozens of helpful articles and resources.
After reading several of those articles, you’ll hopefully come to the conclusion that, unless you are one of the few attorneys dually qualified as an extreme forensic computer geek, you’re far better off leaving the esoteric tasks to experts who know what they’re doing. It won’t be cheap. But before you spend megabucks on an expert, read on.
The flip side of this is that you probably already have—or can easily get—tools that will enable you to deal with much of this technology, and it won’t necessarily require an extreme forensic computer geek or a raid on Fort Knox.
The basic tools
Before looking at some “real world” examples, there are some basic tools you’ll want to have at your disposal. You may already have many of them.
First, your computer should have, at a minimum, a combination drive that will allow you to record CDs and play back DVDs. (We’re beginning to see units shipping with DVD “burners” and, if you want to be a bit ahead of the curve, it might make sense to get one of them.)
If you like portability, a great notebook computer buy is the Hewlett-Packard NX9010, one of the last to include a built-in 3.5-inch floppy disk drive. You can configure it in several ways (you’ll probably want as much memory as you can add) and HP offers discounts (http://www.hp.com/sbso/solutions/legal/discount.html) to lawyers. (I paid a little over $1,100 for mine.) Considering that a notebook can be taken to court and used for a myriad of purposes, I highly recommend getting one.
It’s not necessary to spend a fortune on a computer, but be careful with some of the “deals” offered by retailers. Although prices may seem low, these units are often underpowered or lack necessary components, such as a parallel printer port. Some only include USB 1.1 ports—old technology that’s much slower than USB 2.0. Before buying, make sure the USB ports are USB 2.0. If not, move on.
As for software, you’ll be pleasantly surprised to know that either major “office suite”—Microsoft or WordPerfect—has the capability of reading (and even writing) in many different formats. WordPerfect’s also comes with a neat utility program—Quick View Plus—that’s worth buying (under $40) if you’re a Microsoft user. If you’re working with photographs or digital images, the latest version of Photoshop Elements should be well under $100 and is frequently “on sale.” Otherwise, you’re likely to have all the software you’ll need for many routine electronic evidence tasks. (Make sure you have some blank recordable CD-ROM discs.)
The final major hardware piece is a multifunction flatbed inkjet printer-scanner-copier. Of these, I like Hewlett-Packard’s the best. Pay about $250 to $300—they’re frequently discounted and/or offered with rebates—and some models even have automatic document feeders and a fax machine built in. (Caution: inkjet cartridges need frequent replacement and they’re anything but cheap, so don’t throw out your copier, laser printer, or fax machine.) Use the inkjet multifunction machine to do what these machines can’t: print and copy photographs, copy documents in color, make color transparencies, scan documents, etc. (You’ll need special paper for photographs. Ilford’s glossy inkjet photo paper is less than $30 per 100 sheets at a discount store such as Sam’s Club—a great buy.)
Two other things you may wish to consider. Moving data from one machine to another can be done easily with a cheap USB 2.0 “flash drive” or “jump drive” made by Lexar and others. A 128-megabyte model should run about $35 and can hold the equivalent of 88 floppy disks! Power-users may wish to consider a USB 2.0 external hard drive that can, like the USB 2.0 drives, be easily hooked up and disconnected to any computer with a USB port. A Western Digital 160-megabyte model sells for under $160 at Sam’s Club, which is also a great place to buy USB cables (way overpriced at most other retailers.)
What can you do with it?
Once you’ve got the equipment, what can you do with it? Consider these examples:
• A victim’s injuries were photographed with a digital camera. The images are delivered to you on a CD-ROM. Chances are they’re in the JPEG format (you can tell if the file extension is listed as .jpg). You’ll probably be able to view them with your existing software (Internet Explorer can open JPEG images), but editing and printing these images will need to be done with software such as Photoshop Elements. Size the images to your requirements and print them on the glossy inkjet photo paper in your multifunction machine.
• The same photographs are obtained in traditional prints, but you want duplicates or enlargements. The quick and easy way would be to put them on the multifunction machine’s glass, close the lid, and copy, sizing them to your needs. If you need to scan them into your computer and edit them, the software that came with the multifunction machine and Photoshop Elements should do the job.
• The 911 calls or “buy wire” recordings are given to you on an optical disc. Pop it into the CD-ROM drive and the Windows Media Player software that came with your computer may be able to play them without the need for additional software. Want to copy them to a standard cassette? Easy. You’ll need a miniphone plug to miniphone plug patch cord—an “attenuating one” ($4.29 at Radio Shack) if your cassette recorder only has a microphone input jack. Plug the other end into the headphone jack on your computer and go to it.
• The discovery includes a number of documents furnished on diskettes or a CD-ROM. Again, put the media into the proper drive on your computer and see if your existing software can read them. If your office suite can’t, then try Quick View Plus and, if the document is in PDF format, you can download the latest version of Acrobat Reader from www.adobe.com free of charge.
• What if those “documents” include e-mails in their original format? If they were received by or written in Microsoft Outlook, you should be able to open and read them with the Microsoft Outlook or Outlook Express that’s probably already on your computer.
• You received a DVD of a recorded interview. Pop it into the combination drive. Chances are you’ll be able to view and listen to it with your existing software.
In short, don’t be surprised if, instead of getting photocopies and photographs printed on paper, you get a bunch of CD-ROMs. Before freaking out and hiring an expert, you might be able to open, view, edit, and print with existing hardware and software or obtain them at the nearest strip mall at relatively modest cost.
Of course, there are times when you’ll want to consult experts. There are plenty of them. On the prosecution side, we’ll typically rely first on our fellow government employees and agencies. Some of these resources are also available to the general public. For example, the U.S. Department of Justice’s excellent manual on Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations is available online at http://www.usdoj.gov/criminal/cybercrime/s&smanual2002.htm or http://www.usdoj.gov/criminal/cybercrime/s&smanual2002.pdf without charge. The Federal Judicial Center has a number of electronic discovery resources catalogued for criminal cases at http://www.fjc.gov/newweb/jnetweb.nsf/pages/334 and for civil litigation at http://www.fjc.gov/newweb/jnetweb.nsf/pages/196. George Socha, a consultant on electronic discovery, compiled a lengthy list of resources on his Web site at www.sochaconsulting.com. He’s also written several articles for ABA entities (search on www.abanet.org).
Using e-evidence in court
The bottom line isn’t that electronic evidence is coming—actually, it’s here and there’ll be more of it. The challenge we have as lawyers is whether we’re equipped to receive, review, and use it. On the latter point, how do we use electronic evidence in court?
The answer is usually that electronic evidence may be used in the same way as “hard copy” evidence has always been used, except that it may need to be printed or otherwise displayed. For example, regardless of whether a photograph was recorded on film or digital media, it can be printed on paper. If you have a multifunction inkjet machine, you’ll be able to make your own prints (and an 8x10 print that costs about $8 from a film negative should run you about $2 in paper and ink if made on your inkjet printer). If you want to display digital images in court, an LCD projector costs less than $1,000. You may incorporate digital images in, for example, PowerPoint (or comparable) presentations. The same goes for documents, which can be scanned and projected. Remember, jurors today are watching snazzy forensics on television programs. The judicious use of visual and audio evidence may well make or break your case.
Digital audio recordings may be played back on your computer (which can be hooked up to a courtroom sound system via an inexpensive patch cord). A DVD recording is played back the same way as one you rented at the video store: on a DVD player (or, if you have a combination drive in your laptop, directly from it). Although this may sound complicated, it really isn’t. Each day more courtrooms are becoming electronic friendly although, regrettably, this is happening at a snail’s pace.
One of the chief concerns I repeatedly hear concerning electronic evidence—especially digital images—is the fear that they can be manipulated. In response, I say it’s time for a reality check.
First, all images can be and are adjusted and can be manipulated regardless of whether recorded on film or digital media.
For example, when making a print from a color 35mm negative, certain calibrations are made for exposure and color balance as part of the routine printing process. The same is true for digital images, except that the adjustments are made in the software. Virtually every digital image must be “postprocessed” for color, contrast, and sharpening before being printed or displayed. This is normal and necessary in order to make the printed or displayed image accurately reflect what the photographer saw at the time the image was recorded.
Interestingly, this is precisely the evidentiary standard typically used for the admission of any photograph: Is this photograph a fair and accurate depiction of what the witness saw with his or her own eyes? The media on which the image was originally recorded does not alter that criteria one iota.
Yes, it’s possible to alter an image—digital or film—and it’s been done for years. Of course, it’s easier to remove an obstruction such as a twig or branch with software such as Photoshop, but the evidentiary standard of the photograph used in court, as being a fair and accurate depiction, remains the same. If the contents of an image have been changed to remove what was originally there or add something that wasn’t, then it’s been altered and is no longer necessarily a fair and accurate depiction of the original scene.
To alleviate any concerns over whether a digital photograph has been altered, I recommend that the original recorded image be preserved and the postprocessed image be saved with a different file name. That way the two can be compared if there’s any question.
The somewhat mysterious world of digital or electronic evidence is perhaps becoming less mysterious as we become more acclimated to and educated about it; nonetheless, remember that there are times when certain tasks are best left to experts. Recovering deleted files from a seized hard drive is not something for anyone but an expert to do. In short, if you don’t know how to do something or aren’t comfortable doing it, stop. Take a deep breath. Ask yourself whether it would make more sense to let someone with more expertise do it. If so, don’t mess with it.
No matter what you do, don’t do anything without backing up the original! You can buy 100 blank CD-ROMs for less than $30. It won’t kill you to spend 30 cents to make a copy of that CD-ROM with the crime scene photographs. Lose, damage, or otherwise screw up the original and you’ll wish you had. Repeat one of my favorite mantras: Backup is cheap; restoration is either impossible or incredibly expensive.