| Today, we live in an expanding digital world. | | | | assets or other relevant information in |
| On any given day, many people use a myriad | | | | divorce can be profound. The party that |
| of digital equipment to process, store and | | | | fails to disclose the asset during the |
| send data. Digital tools that are commonly | | | | divorce process may be required to pay |
| used may include, without limitation: | | | | attorney's fees, turn over the asset to the |
| | | | other party or to the court in a receivership |
| Desk top computers | | | | proceeding in addition to calling into |
| | | | question that party's credibility in the |
| Laptop computerspersonal digital assistants | | | | proceedings as a whole. Actively pursing |
| (PDA) which act as electronic organizers or | | | | this avenue of investigation may be the |
| day planners that are portable, easy to use | | | | difference between losing out on significant |
| and capable of sharing information with your | | | | assets or finding a treasure trove of |
| PC. | | | | financial information from local investments |
| | | | and real estate holdings even if they are |
| Cell Phones; | | | | held in the name of another person or |
| | | | sheltered as part of a holding company. In |
| TIVO (which can be modified to store data); | | | | practice, forensic examinations have been |
| | | | effective in turning up financial |
| Digital Cameras. | | | | institutions to explore for hidden accounts |
| | | | and discovering wealth transfers to overseas |
| These devices offer a rich source of | | | | repositories. |
| information which often overlooked in divorce | | | | |
| proceedings. Any of these digital databases | | | | The goal of computer forensics is to do a |
| may be forensically examined as part of the | | | | structured investigation and find out exactly |
| divorce discovery process. This may involve | | | | what happened on a digital system, and who |
| making a mirrored copy of hard drives, | | | | was responsible for it. Hiring a qualified |
| examining stored data or recovering deleted | | | | expert is critical to such an investigation. |
| information. | | | | Any manipulation of a digital device from an |
| | | | untrained person may effectively destroy the |
| Clearly, such a forensic analysis can be an | | | | admissibility of any evidence found since |
| indispensable tool in high conflict divorce | | | | such information in untrained hands may be |
| cases where there is a suspicion of wealth | | | | manipulated and modified by mistake or |
| transfers or to locate proof of infidelity or | | | | design. A forensic expert, by contrast, must |
| other fault based conduct. Information | | | | take great pains to preserve the data in its |
| obtainable may include: | | | | original form before even commencing an |
| | | | analysis. This means that forensic examiners |
| (1) e-mail messages; | | | | must take steps to ensure the integrity of |
| | | | the information contained within those |
| (2) instant messages; | | | | physical items while developing methods and |
| | | | techniques that provide valid and reliable |
| (3) user names; passwords; | | | | results while protecting the real |
| | | | evidence-the information-from harm. In the |
| (4) names and addresses of financial | | | | context of a computer hard drive, this may |
| institutions; | | | | mean making a mirrored hard drive so that the |
| | | | original condition of the hard drive is |
| (5) asset transfers; | | | | preserved for any subsequent investigation. |
| | | | |
| (6)fund transfers; | | | | Forensic expert generally use three phases |
| | | | for recovering evidence from a computer |
| (7) debt information; | | | | system or storage medium. Those phases |
| | | | include: |
| (8) account activity; | | | | |
| | | | (1) Acquiring the data; |
| (9) monitoring activity including creating | | | | |
| chronological timelines for computer program | | | | (2) Analyzing the data; and |
| use; | | | | |
| | | | (3) Reporting the data. |
| (10) recovering deleted, encrypted, or | | | | |
| damaged file information. | | | | (4) Digital device users, including computer |
| | | | users, always leave tracks. According to |
| It is important to remember that deleted | | | | computer forensic experts, it is "just" a |
| information is never truly deleted. Even | | | | matter of finding these tracks. |
| formatting the hard drive of a computer does | | | | |
| not erase stored date and, instead, simply | | | | It is important to recognize that computer |
| erases the links that point to where the data | | | | evidence almost never exists in isolation. |
| can be located. In fact, computer experts | | | | It is a product of the data stored, the |
| claim that if an amateur tried to burn their | | | | application used to create and store it, and |
| computer in a fireplace, there is a very good | | | | the computer system that directed these |
| chance the data could still be recovered. | | | | activities. Even the applications used to |
| What is even more compelling is that, in many | | | | create data may serve a critical role. |
| instances, the most important evidence is | | | | |
| proof that there was an attempt to destroy | | | | For example, in one particular divorce |
| data. Some things that may be discovered in | | | | proceeding, discovery was served to acquire |
| a forensic examination include: | | | | financial records related to a family owned |
| | | | business. In response, the spouse that |
| (1) Saved Files - These are data files that | | | | operated the business provided profit and |
| exist in a form that can be readily used. | | | | loss statements and general ledgers for a |
| They can often be located in named and | | | | four year period. the records seemed to |
| organized directories. However, a good | | | | minimize the corporate assets and income. As |
| investigator will look further for files that | | | | a result, a Motion was brought to perform a |
| are hidden in strange directories or even | | | | forensic analysis on the computer system |
| marked to be hidden from the operating | | | | where the records were purportedly stored. At |
| system. Often, computer users attempt to | | | | trial, it was revealed that the computer that |
| hide files by adding suffixes to the file | | | | was analyzed had been used to modify the |
| name like .exe in order to avoid detection. | | | | data. Specifically, a program designed to |
| | | | erase data was downloaded and used to remove |
| (2) Deleted Files - When a file is deleted | | | | items from the hard drive only shortly before |
| from a computer, it is not altered. The | | | | the computer was turned over to the forensic |
| operating system is just told to ignore that | | | | examiner. Even more compelling, the forensic |
| it exists. Unless the operating system writes | | | | examiner was able to determine that the |
| new data over the old, it may be recovered. | | | | financial records that were provided by the |
| | | | spouse had been created by a program version |
| (3) Temporary Files - Operating systems and | | | | that was not in use at the time the records |
| programs temporarily store a copy of working | | | | were purportedly compiled. The end result |
| data in various places. Sometimes it is in | | | | was that the court imposed a sanction against |
| the same location as the original. More | | | | the party providing the records including a |
| frequently it is in a specially designated | | | | presumption that the records had been |
| folder specifically for temporary files. | | | | modified and were inaccurate. |
| | | | |
| (4) Metadata - This is a term that refers to | | | | Conclusion |
| corollary information that is stored along | | | | |
| with data. It includes such things as the | | | | Valid and reliable methods to recover data |
| date the file was created, modified and last | | | | from computers as part of discovery in |
| accessed. It can tell us the original owner | | | | divorce proceedings are becoming fundamental |
| as well as everyone who has ever used it. | | | | for divorce lawyers. this is particularly |
| Sometimes it contains previous versions of | | | | true in cases with larger estates, |
| the document. | | | | complicated business or real estate holdings |
| | | | or multi-jurisdictional assets. These |
| (5) Disk Slack - When data is stored, it | | | | methods must not be overlooked. However, in |
| accidentally captures data from previous | | | | such cases, it is critical to hire an |
| documents. With the certain forensic | | | | attorney and a computer forensic expert |
| software, this datas can be searched and the | | | | capable of finding necessary information and |
| old data resurrected. | | | | presenting it effectively in court. For |
| | | | legal representation call 612.240. |
| The consequences of discovering undisclosed | | | | |