Divorce and Computer Evidence

Today, we live in an expanding digital world. Onquestion that party's credibility in the proceedings
any given day, many people use a myriad ofas a whole. Actively pursing this avenue of
digital equipment to process, store and send data.investigation may be the difference between
Digital tools that are commonly used may include,losing out on significant assets or finding a
without limitation:treasure trove of financial information from local
Desk top computersinvestments and real estate holdings even if they
Laptop computerspersonal digital assistants (PDA)are held in the name of another person or
which act as electronic organizers or day plannerssheltered as part of a holding company. In
that are portable, easy to use and capable ofpractice, forensic examinations have been
sharing information with your PC.effective in turning up financial institutions to
Cell Phones;explore for hidden accounts and discovering
TIVO (which can be modified to store data);wealth transfers to overseas repositories.
Digital Cameras.The goal of computer forensics is to do a
These devices offer a rich source of informationstructured investigation and find out exactly what
which often overlooked in divorce proceedings.happened on a digital system, and who was
Any of these digital databases may be forensicallyresponsible for it. Hiring a qualified expert is critical
examined as part of the divorce discoveryto such an investigation. Any manipulation of a
process. This may involve making a mirroreddigital device from an untrained person may
copy of hard drives, examining stored data oreffectively destroy the admissibility of any
recovering deleted information.evidence found since such information in untrained
Clearly, such a forensic analysis can be anhands may be manipulated and modified by
indispensable tool in high conflict divorce casesmistake or design. A forensic expert, by contrast,
where there is a suspicion of wealth transfers ormust take great pains to preserve the data in its
to locate proof of infidelity or other fault basedoriginal form before even commencing an analysis.
conduct. Information obtainable may include:This means that forensic examiners must take
(1) e-mail messages;steps to ensure the integrity of the information
(2) instant messages;contained within those physical items while
(3) user names; passwords;developing methods and techniques that provide
(4) names and addresses of financial institutions;valid and reliable results while protecting the real
(5) asset transfers;evidence-the information-from harm. In the
(6)fund transfers;context of a computer hard drive, this may mean
(7) debt information;making a mirrored hard drive so that the original
(8) account activity;condition of the hard drive is preserved for any
(9) monitoring activity including creatingsubsequent investigation.
chronological timelines for computer program use;Forensic expert generally use three phases for
(10) recovering deleted, encrypted, or damagedrecovering evidence from a computer system or
file information.storage medium. Those phases include:
It is important to remember that deleted(1) Acquiring the data;
information is never truly deleted. Even formatting(2) Analyzing the data; and
the hard drive of a computer does not erase(3) Reporting the data.
stored date and, instead, simply erases the links(4) Digital device users, including computer users,
that point to where the data can be located. Inalways leave tracks. According to computer
fact, computer experts claim that if an amateurforensic experts, it is "just" a matter of finding
tried to burn their computer in a fireplace, there isthese tracks.
a very good chance the data could still beIt is important to recognize that computer
recovered. What is even more compelling is that,evidence almost never exists in isolation. It is a
in many instances, the most important evidence isproduct of the data stored, the application used
proof that there was an attempt to destroy data.to create and store it, and the computer system
Some things that may be discovered in a forensicthat directed these activities. Even the applications
examination include:used to create data may serve a critical role.
(1) Saved Files - These are data files that exist inFor example, in one particular divorce proceeding,
a form that can be readily used. They can oftendiscovery was served to acquire financial records
be located in named and organized directories.related to a family owned business. In response,
However, a good investigator will look further forthe spouse that operated the business provided
files that are hidden in strange directories or evenprofit and loss statements and general ledgers for
marked to be hidden from the operating system.a four year period. the records seemed to
Often, computer users attempt to hide files byminimize the corporate assets and income. As a
adding suffixes to the file name like .exe in orderresult, a Motion was brought to perform a
to avoid detection.forensic analysis on the computer system where
(2) Deleted Files - When a file is deleted from athe records were purportedly stored. At trial, it
computer, it is not altered. The operating systemwas revealed that the computer that was
is just told to ignore that it exists. Unless theanalyzed had been used to modify the data.
operating system writes new data over the old, itSpecifically, a program designed to erase data
may be recovered.was downloaded and used to remove items from
(3) Temporary Files - Operating systems andthe hard drive only shortly before the computer
programs temporarily store a copy of workingwas turned over to the forensic examiner. Even
data in various places. Sometimes it is in the samemore compelling, the forensic examiner was able
location as the original. More frequently it is in ato determine that the financial records that were
specially designated folder specifically forprovided by the spouse had been created by a
temporary files.program version that was not in use at the time
(4) Metadata - This is a term that refers tothe records were purportedly compiled. The end
corollary information that is stored along with data.result was that the court imposed a sanction
It includes such things as the date the file wasagainst the party providing the records including a
created, modified and last accessed. It can tell uspresumption that the records had been modified
the original owner as well as everyone who hasand were inaccurate.
ever used it. Sometimes it contains previousConclusion
versions of the document.Valid and reliable methods to recover data from
(5) Disk Slack - When data is stored, itcomputers as part of discovery in divorce
accidentally captures data from previousproceedings are becoming fundamental for
documents. With the certain forensic software,divorce lawyers. this is particularly true in cases
this datas can be searched and the old datawith larger estates, complicated business or real
resurrected.estate holdings or multi-jurisdictional assets. These
The consequences of discovering undisclosedmethods must not be overlooked. However, in
assets or other relevant information in divorcesuch cases, it is critical to hire an attorney and a
can be profound. The party that fails to disclosecomputer forensic expert capable of finding
the asset during the divorce process may benecessary information and presenting it
required to pay attorney's fees, turn over theeffectively in court. For legal representation call
asset to the other party or to the court in a612.240.
receivership proceeding in addition to calling into