| Today, we live in an expanding digital world. On | | | | question that party's credibility in the proceedings |
| any given day, many people use a myriad of | | | | as a whole. Actively pursing this avenue of |
| digital equipment to process, store and send data. | | | | investigation may be the difference between |
| Digital tools that are commonly used may include, | | | | losing out on significant assets or finding a |
| without limitation: | | | | treasure trove of financial information from local |
| Desk top computers | | | | investments and real estate holdings even if they |
| Laptop computerspersonal digital assistants (PDA) | | | | are held in the name of another person or |
| which act as electronic organizers or day planners | | | | sheltered as part of a holding company. In |
| that are portable, easy to use and capable of | | | | practice, forensic examinations have been |
| sharing information with your PC. | | | | effective in turning up financial institutions to |
| Cell Phones; | | | | explore for hidden accounts and discovering |
| TIVO (which can be modified to store data); | | | | wealth transfers to overseas repositories. |
| Digital Cameras. | | | | The goal of computer forensics is to do a |
| These devices offer a rich source of information | | | | structured investigation and find out exactly what |
| which often overlooked in divorce proceedings. | | | | happened on a digital system, and who was |
| Any of these digital databases may be forensically | | | | responsible for it. Hiring a qualified expert is critical |
| examined as part of the divorce discovery | | | | to such an investigation. Any manipulation of a |
| process. This may involve making a mirrored | | | | digital device from an untrained person may |
| copy of hard drives, examining stored data or | | | | effectively destroy the admissibility of any |
| recovering deleted information. | | | | evidence found since such information in untrained |
| Clearly, such a forensic analysis can be an | | | | hands may be manipulated and modified by |
| indispensable tool in high conflict divorce cases | | | | mistake or design. A forensic expert, by contrast, |
| where there is a suspicion of wealth transfers or | | | | must take great pains to preserve the data in its |
| to locate proof of infidelity or other fault based | | | | original form before even commencing an analysis. |
| conduct. Information obtainable may include: | | | | This means that forensic examiners must take |
| (1) e-mail messages; | | | | steps to ensure the integrity of the information |
| (2) instant messages; | | | | contained within those physical items while |
| (3) user names; passwords; | | | | developing methods and techniques that provide |
| (4) names and addresses of financial institutions; | | | | valid and reliable results while protecting the real |
| (5) asset transfers; | | | | evidence-the information-from harm. In the |
| (6)fund transfers; | | | | context of a computer hard drive, this may mean |
| (7) debt information; | | | | making a mirrored hard drive so that the original |
| (8) account activity; | | | | condition of the hard drive is preserved for any |
| (9) monitoring activity including creating | | | | subsequent investigation. |
| chronological timelines for computer program use; | | | | Forensic expert generally use three phases for |
| (10) recovering deleted, encrypted, or damaged | | | | recovering evidence from a computer system or |
| file information. | | | | storage medium. Those phases include: |
| It is important to remember that deleted | | | | (1) Acquiring the data; |
| information is never truly deleted. Even formatting | | | | (2) Analyzing the data; and |
| the hard drive of a computer does not erase | | | | (3) Reporting the data. |
| stored date and, instead, simply erases the links | | | | (4) Digital device users, including computer users, |
| that point to where the data can be located. In | | | | always leave tracks. According to computer |
| fact, computer experts claim that if an amateur | | | | forensic experts, it is "just" a matter of finding |
| tried to burn their computer in a fireplace, there is | | | | these tracks. |
| a very good chance the data could still be | | | | It is important to recognize that computer |
| recovered. What is even more compelling is that, | | | | evidence almost never exists in isolation. It is a |
| in many instances, the most important evidence is | | | | product of the data stored, the application used |
| proof that there was an attempt to destroy data. | | | | to create and store it, and the computer system |
| Some things that may be discovered in a forensic | | | | that directed these activities. Even the applications |
| examination include: | | | | used to create data may serve a critical role. |
| (1) Saved Files - These are data files that exist in | | | | For example, in one particular divorce proceeding, |
| a form that can be readily used. They can often | | | | discovery was served to acquire financial records |
| be located in named and organized directories. | | | | related to a family owned business. In response, |
| However, a good investigator will look further for | | | | the spouse that operated the business provided |
| files that are hidden in strange directories or even | | | | profit and loss statements and general ledgers for |
| marked to be hidden from the operating system. | | | | a four year period. the records seemed to |
| Often, computer users attempt to hide files by | | | | minimize the corporate assets and income. As a |
| adding suffixes to the file name like .exe in order | | | | result, a Motion was brought to perform a |
| to avoid detection. | | | | forensic analysis on the computer system where |
| (2) Deleted Files - When a file is deleted from a | | | | the records were purportedly stored. At trial, it |
| computer, it is not altered. The operating system | | | | was revealed that the computer that was |
| is just told to ignore that it exists. Unless the | | | | analyzed had been used to modify the data. |
| operating system writes new data over the old, it | | | | Specifically, a program designed to erase data |
| may be recovered. | | | | was downloaded and used to remove items from |
| (3) Temporary Files - Operating systems and | | | | the hard drive only shortly before the computer |
| programs temporarily store a copy of working | | | | was turned over to the forensic examiner. Even |
| data in various places. Sometimes it is in the same | | | | more compelling, the forensic examiner was able |
| location as the original. More frequently it is in a | | | | to determine that the financial records that were |
| specially designated folder specifically for | | | | provided by the spouse had been created by a |
| temporary files. | | | | program version that was not in use at the time |
| (4) Metadata - This is a term that refers to | | | | the records were purportedly compiled. The end |
| corollary information that is stored along with data. | | | | result was that the court imposed a sanction |
| It includes such things as the date the file was | | | | against the party providing the records including a |
| created, modified and last accessed. It can tell us | | | | presumption that the records had been modified |
| the original owner as well as everyone who has | | | | and were inaccurate. |
| ever used it. Sometimes it contains previous | | | | Conclusion |
| versions of the document. | | | | Valid and reliable methods to recover data from |
| (5) Disk Slack - When data is stored, it | | | | computers as part of discovery in divorce |
| accidentally captures data from previous | | | | proceedings are becoming fundamental for |
| documents. With the certain forensic software, | | | | divorce lawyers. this is particularly true in cases |
| this datas can be searched and the old data | | | | with larger estates, complicated business or real |
| resurrected. | | | | estate holdings or multi-jurisdictional assets. These |
| The consequences of discovering undisclosed | | | | methods must not be overlooked. However, in |
| assets or other relevant information in divorce | | | | such cases, it is critical to hire an attorney and a |
| can be profound. The party that fails to disclose | | | | computer forensic expert capable of finding |
| the asset during the divorce process may be | | | | necessary information and presenting it |
| required to pay attorney's fees, turn over the | | | | effectively in court. For legal representation call |
| asset to the other party or to the court in a | | | | 612.240. |
| receivership proceeding in addition to calling into | | | | |