When you are charged with a computer crime, you want an attorney that will do everything he or she can to defend you. Staying out of prison, avoiding a criminal record and protecting your family is important to you. Then why would you hire an attorney for a computer crime if that attorney doesn't know anything about computer forensics?
As an attorney, we have to be experts in everything. That's what makes this job so fun. While we cannot be experts in everything all of the time, we need to have a basic understanding of the issues that we will face. Its the same reason why the days of the general practitioner are pretty much dead. There is just too much out there to know. Thus, I don't expect that many attorneys will become a computer forensics
…show more content…
Again, while a defense expert can help, they should not be relied upon to interpret the entire case. In my cases, I rarely need my expert to tell me what the defenses are. Instead, I need the expert to testify as I cannot.
Just about every computer crime case involves some degree of computer forensics. If the defense attorney just assumes that police are correct, then the attorney is not properly defending the client. Computer forensics involves the collection, preservation, filtering and presentation of digital evidence. In each stage of this process, something can go seriously wrong that could make it seem like the client is guilty when they are in fact, innocent.
Collection of digital evidence is when artifacts considered to be of evidentiary value are identified and collected. They can take the forms of external disks, computers, phones, video game consoles, servers and any other device capable of recording data. The large number of storage devices and their ever decreasing size present a big problem for law enforcement. For defense attorneys, who collects this evidence and how is very important to the case especially when non-law enforcement people collect
…show more content…
Evidentiary/suspect files are extracted and non-suspect files are filtered out. Due to the increasing size of hard drives and the lack of staff, this process can take many months. The computer crime defense lawyer must have a good grasp on exactly what the examiner is doing and why. Quite often, the examiner will rely upon automated tools to speed up the filtering process. While this allows them to "cut to the chase" pretty quickly, it may also present one side of the story. Defense lawyers cannot rely upon their own experts to know what to look for when crafting a defense. Instead, they must have a grasp of everything the examiner could have done but chose not to for whatever reason. What files were not examined? What settings were used with the automated tools? As a result, what files were ignored and why? What do those files show? What could they have shown? To be effective, the state must nail down everything. When they don't, they hand the defense a blank slate to which the defense attorney can write down and present to the jury, just about