Welcome to your ultimate Idaho travel resource


Divorce and Computer Evidence

Today, we live in an expanding digital world.assets or other relevant information in
On any given day, many people use a myriaddivorce can be profound. The party that
of digital equipment to process, store andfails to disclose the asset during the
send data. Digital tools that are commonlydivorce process may be required to pay
used  may  include,  without  limitation:attorney's fees, turn over the asset to the
other party or to the court in a receivership
Desk  top  computersproceeding in addition to calling into
question that party's credibility in the
Laptop computerspersonal digital assistantsproceedings as a whole. Actively pursing
(PDA) which act as electronic organizers orthis avenue of investigation may be the
day planners that are portable, easy to usedifference between losing out on significant
and capable of sharing information with yourassets or finding a treasure trove of
PC.financial information from local investments
and real estate holdings even if they are
Cell  Phones;held in the name of another person or
sheltered as part of a holding company. In
TIVO  (which  can be modified to store data);practice, forensic examinations have been
effective in turning up financial
Digital  Cameras.institutions to explore for hidden accounts
and discovering wealth transfers to overseas
These devices offer a rich source ofrepositories.
information which often overlooked in divorce
proceedings. Any of these digital databasesThe goal of computer forensics is to do a
may be forensically examined as part of thestructured investigation and find out exactly
divorce discovery process. This may involvewhat happened on a digital system, and who
making a mirrored copy of hard drives,was responsible for it. Hiring a qualified
examining stored data or recovering deletedexpert is critical to such an investigation.
information.Any manipulation of a digital device from an
untrained person may effectively destroy the
Clearly, such a forensic analysis can be anadmissibility of any evidence found since
indispensable tool in high conflict divorcesuch information in untrained hands may be
cases where there is a suspicion of wealthmanipulated and modified by mistake or
transfers or to locate proof of infidelity ordesign. A forensic expert, by contrast, must
other fault based conduct. Informationtake great pains to preserve the data in its
obtainable  may  include:original form before even commencing an
analysis. This means that forensic examiners
(1)  e-mail  messages;must take steps to ensure the integrity of
the information contained within those
(2)  instant  messages;physical items while developing methods and
techniques that provide valid and reliable
(3)  user  names;  passwords;results while protecting the real
evidence-the information-from harm. In the
(4) names and addresses of financialcontext of a computer hard drive, this may
institutions;mean making a mirrored hard drive so that the
original condition of the hard drive is
(5)  asset  transfers;preserved  for  any subsequent investigation.
(6)fund  transfers;Forensic expert generally use three phases
for recovering evidence from a computer
(7)  debt  information;system or storage medium. Those phases
include:
(8)  account  activity;
(1)  Acquiring  the  data;
(9) monitoring activity including creating
chronological timelines for computer program(2)  Analyzing  the  data;  and
use;
(3)  Reporting  the  data.
(10) recovering deleted, encrypted, or
damaged  file  information.(4) Digital device users, including computer
users, always leave tracks. According to
It is important to remember that deletedcomputer forensic experts, it is "just" a
information is never truly deleted. Evenmatter  of  finding  these  tracks.
formatting the hard drive of a computer does
not erase stored date and, instead, simplyIt is important to recognize that computer
erases the links that point to where the dataevidence almost never exists in isolation.
can be located. In fact, computer expertsIt is a product of the data stored, the
claim that if an amateur tried to burn theirapplication used to create and store it, and
computer in a fireplace, there is a very goodthe computer system that directed these
chance the data could still be recovered.activities. Even the applications used to
What is even more compelling is that, in manycreate  data  may  serve  a  critical  role.
instances, the most important evidence is
proof that there was an attempt to destroyFor example, in one particular divorce
data. Some things that may be discovered inproceeding, discovery was served to acquire
a  forensic  examination  include:financial records related to a family owned
business. In response, the spouse that
(1) Saved Files - These are data files thatoperated the business provided profit and
exist in a form that can be readily used.loss statements and general ledgers for a
They can often be located in named andfour year period. the records seemed to
organized directories. However, a goodminimize the corporate assets and income. As
investigator will look further for files thata result, a Motion was brought to perform a
are hidden in strange directories or evenforensic analysis on the computer system
marked to be hidden from the operatingwhere the records were purportedly stored. At
system. Often, computer users attempt totrial, it was revealed that the computer that
hide files by adding suffixes to the filewas analyzed had been used to modify the
name  like  .exe in order to avoid detection.data. Specifically, a program designed to
erase data was downloaded and used to remove
(2) Deleted Files - When a file is deleteditems from the hard drive only shortly before
from a computer, it is not altered. Thethe computer was turned over to the forensic
operating system is just told to ignore thatexaminer. Even more compelling, the forensic
it exists. Unless the operating system writesexaminer was able to determine that the
new  data  over the old, it may be recovered.financial records that were provided by the
spouse had been created by a program version
(3) Temporary Files - Operating systems andthat was not in use at the time the records
programs temporarily store a copy of workingwere purportedly compiled. The end result
data in various places. Sometimes it is inwas that the court imposed a sanction against
the same location as the original. Morethe party providing the records including a
frequently it is in a specially designatedpresumption that the records had been
folder  specifically  for  temporary  files.modified  and  were  inaccurate.
(4) Metadata - This is a term that refers toConclusion
corollary information that is stored along
with data. It includes such things as theValid and reliable methods to recover data
date the file was created, modified and lastfrom computers as part of discovery in
accessed. It can tell us the original ownerdivorce proceedings are becoming fundamental
as well as everyone who has ever used it.for divorce lawyers. this is particularly
Sometimes it contains previous versions oftrue in cases with larger estates,
the  document.complicated business or real estate holdings
or multi-jurisdictional assets. These
(5) Disk Slack - When data is stored, itmethods must not be overlooked. However, in
accidentally captures data from previoussuch cases, it is critical to hire an
documents. With the certain forensicattorney and a computer forensic expert
software, this datas can be searched and thecapable of finding necessary information and
old  data  resurrected.presenting it effectively in court. For
legal representation call 612.240.
The consequences of discovering undisclosed



1 A B C D E 69 70 71 72 73 74 75 76 77 78 79 80 81 83 84 85 86 87 88 89 90 91 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 112 113 114 115 116 117 118 119 120 121 122