| Today, we live in an expanding digital
| |
| | addition to calling into question that
|
| world. On any given day, many people use
| |
| | party's credibility in the proceedings as
|
| a myriad of digital equipment to process,
| |
| | a whole. Actively pursing this avenue of
|
| store and send data. Digital tools that
| |
| | investigation may be the difference
|
| are commonly used may include, without
| |
| | between losing out on significant assets
|
| limitation:
| |
| | or finding a treasure trove of financial
|
| Desk top computers
| |
| | information from local investments and
|
| Laptop computerspersonal digital
| |
| | real estate holdings even if they are
|
| assistants (PDA) which act as electronic
| |
| | held in the name of another person or
|
| organizers or day planners that are
| |
| | sheltered as part of a holding company.
|
| portable, easy to use and capable of
| |
| | In practice, forensic examinations have
|
| sharing information with your PC.
| |
| | been effective in turning up financial
|
| Cell Phones;
| |
| | institutions to explore for hidden
|
| TIVO (which can be modified to store
| |
| | accounts and discovering wealth transfers
|
| data);
| |
| | to overseas repositories.
|
| Digital Cameras.
| |
| | The goal of computer forensics is to do a
|
| These devices offer a rich source of
| |
| | structured investigation and find out
|
| information which often overlooked in
| |
| | exactly what happened on a digital
|
| divorce proceedings. Any of these
| |
| | system, and who was responsible for it.
|
| digital databases may be forensically
| |
| | Hiring a qualified expert is critical to
|
| examined as part of the divorce discovery
| |
| | such an investigation. Any manipulation
|
| process. This may involve making a
| |
| | of a digital device from an untrained
|
| mirrored copy of hard drives, examining
| |
| | person may effectively destroy the
|
| stored data or recovering deleted
| |
| | admissibility of any evidence found since
|
| information.
| |
| | such information in untrained hands may
|
| Clearly, such a forensic analysis can be
| |
| | be manipulated and modified by mistake or
|
| an indispensable tool in high conflict
| |
| | design. A forensic expert, by contrast,
|
| divorce cases where there is a suspicion
| |
| | must take great pains to preserve the
|
| of wealth transfers or to locate proof of
| |
| | data in its original form before even
|
| infidelity or other fault based conduct.
| |
| | commencing an analysis. This means that
|
| Information obtainable may include:
| |
| | forensic examiners must take steps to
|
| (1) e-mail messages;
| |
| | ensure the integrity of the information
|
| (2) instant messages;
| |
| | contained within those physical items
|
| (3) user names; passwords;
| |
| | while developing methods and techniques
|
| (4) names and addresses of financial
| |
| | that provide valid and reliable results
|
| institutions;
| |
| | while protecting the real evidence-the
|
| (5) asset transfers;
| |
| | information-from harm. In the context of
|
| (6)fund transfers;
| |
| | a computer hard drive, this may mean
|
| (7) debt information;
| |
| | making a mirrored hard drive so that the
|
| (8) account activity;
| |
| | original condition of the hard drive is
|
| (9) monitoring activity including
| |
| | preserved for any subsequent
|
| creating chronological timelines for
| |
| | investigation.
|
| computer program use;
| |
| | Forensic expert generally use three
|
| (10) recovering deleted, encrypted, or
| |
| | phases for recovering evidence from a
|
| damaged file information.
| |
| | computer system or storage medium. Those
|
| It is important to remember that deleted
| |
| | phases include:
|
| information is never truly deleted. Even
| |
| | (1) Acquiring the data;
|
| formatting the hard drive of a computer
| |
| | (2) Analyzing the data; and
|
| does not erase stored date and, instead,
| |
| | (3) Reporting the data.
|
| simply erases the links that point to
| |
| | (4) Digital device users, including
|
| where the data can be located. In fact,
| |
| | computer users, always leave tracks.
|
| computer experts claim that if an amateur
| |
| | According to computer forensic experts,
|
| tried to burn their computer in a
| |
| | it is "just" a matter of finding these
|
| fireplace, there is a very good chance
| |
| | tracks.
|
| the data could still be recovered. What
| |
| | It is important to recognize that
|
| is even more compelling is that, in many
| |
| | computer evidence almost never exists in
|
| instances, the most important evidence is
| |
| | isolation. It is a product of the data
|
| proof that there was an attempt to
| |
| | stored, the application used to create
|
| destroy data. Some things that may be
| |
| | and store it, and the computer system
|
| discovered in a forensic examination
| |
| | that directed these activities. Even the
|
| include:
| |
| | applications used to create data may
|
| (1) Saved Files - These are data files
| |
| | serve a critical role.
|
| that exist in a form that can be readily
| |
| | For example, in one particular divorce
|
| used. They can often be located in named
| |
| | proceeding, discovery was served to
|
| and organized directories. However, a
| |
| | acquire financial records related to a
|
| good investigator will look further for
| |
| | family owned business. In response, the
|
| files that are hidden in strange
| |
| | spouse that operated the business
|
| directories or even marked to be hidden
| |
| | provided profit and loss statements and
|
| from the operating system. Often,
| |
| | general ledgers for a four year period.
|
| computer users attempt to hide files by
| |
| | the records seemed to minimize the
|
| adding suffixes to the file name like
| |
| | corporate assets and income. As a
|
| .exe in order to avoid detection.
| |
| | result, a Motion was brought to perform a
|
| (2) Deleted Files - When a file is
| |
| | forensic analysis on the computer system
|
| deleted from a computer, it is not
| |
| | where the records were purportedly
|
| altered. The operating system is just
| |
| | stored. At trial, it was revealed that
|
| told to ignore that it exists. Unless the
| |
| | the computer that was analyzed had been
|
| operating system writes new data over the
| |
| | used to modify the data. Specifically, a
|
| old, it may be recovered.
| |
| | program designed to erase data was
|
| (3) Temporary Files - Operating systems
| |
| | downloaded and used to remove items from
|
| and programs temporarily store a copy of
| |
| | the hard drive only shortly before the
|
| working data in various places. Sometimes
| |
| | computer was turned over to the forensic
|
| it is in the same location as the
| |
| | examiner. Even more compelling, the
|
| original. More frequently it is in a
| |
| | forensic examiner was able to determine
|
| specially designated folder specifically
| |
| | that the financial records that were
|
| for temporary files.
| |
| | provided by the spouse had been created
|
| (4) Metadata - This is a term that refers
| |
| | by a program version that was not in use
|
| to corollary information that is stored
| |
| | at the time the records were purportedly
|
| along with data. It includes such things
| |
| | compiled. The end result was that the
|
| as the date the file was created,
| |
| | court imposed a sanction against the
|
| modified and last accessed. It can tell
| |
| | party providing the records including a
|
| us the original owner as well as everyone
| |
| | presumption that the records had been
|
| who has ever used it. Sometimes it
| |
| | modified and were inaccurate.
|
| contains previous versions of the
| |
| | Conclusion
|
| document.
| |
| | Valid and reliable methods to recover
|
| (5) Disk Slack - When data is stored, it
| |
| | data from computers as part of discovery
|
| accidentally captures data from previous
| |
| | in divorce proceedings are becoming
|
| documents. With the certain forensic
| |
| | fundamental for divorce lawyers. this is
|
| software, this datas can be searched and
| |
| | particularly true in cases with larger
|
| the old data resurrected.
| |
| | estates, complicated business or real
|
| The consequences of discovering
| |
| | estate holdings or multi-jurisdictional
|
| undisclosed assets or other relevant
| |
| | assets. These methods must not be
|
| information in divorce can be profound.
| |
| | overlooked. However, in such cases, it
|
| The party that fails to disclose the
| |
| | is critical to hire an attorney and a
|
| asset during the divorce process may be
| |
| | computer forensic expert capable of
|
| required to pay attorney's fees, turn
| |
| | finding necessary information and
|
| over the asset to the other party or to
| |
| | presenting it effectively in court.
|
| the court in a receivership proceeding in
| |
| | For legal representation call 612.240.
|
