You can tell a lot about a person from his or her computer hard drive, toll-booth pass, or TiVo account.

More difficult to ascertain from a computer forensic analyst's perspective, however, is the reliability of the information that's revealed.

Prosecutors trying Alejandro Avila for the rape and murder of 6-year-old Samantha Runnion in California hope to bolster their case by introducing evidence of child pornography allegedly found on his computer hard drive.

In Scott Peterson's double-murder trial, prosecutors hope patterns exhibited by electronic records such as GPS data from the defendant's car and cell phone, wiretaps of phone conversations with his mistress, and Internet history files from his personal and business computers will provide jurors with enough circumstantial evidence to imply a motive.

Story continues

advertisement

The strategies exhibited by both prosecution teams reflect a growing trend toward relying on digital evidence, not only to prove straightforward charges, such as possession of child pornography, but to imply motive or intent by generating a "digital profile" of a crime suspect.

Revealing e-mails

This strategy proved successful for Los Angeles deputy district attorney Bobby Grace during his prosecution of a former minister accused of shooting and killing his wife and daughter in their home.

After Judge Lance Ito ruled that a computer seized from defendant Henry Hayes' home was inadmissible evidence, Grace went after a computer belonging to Hayes' mistress to retrieve e-mails from her hard drive.

"We were trying to prove a motive and intent for the killing of Hayes' wife and 7-year-old daughter, and he provided a large part of that in these e-mails," Grace said. "He admits to having the affair and talks about how he can't wait to be with her and that he wants to marry her."

According to time and date stamps, Grace determined that the intense e-mails reached a fever pitch in the weeks before the murders, and then suddenly stopped two days before Hayes' wife and daughter were found dead in their home.

As soon as the funeral passed, the e-mails resumed.

Although confident that he would have won a conviction regardless, Grace acknowledges the emails gave his case a vital boost.

"The general perception is circumstantial evidence is not as good as direct evidence, but it's really just as good if a jury finds that all facts that support it are true beyond a reasonable doubt," he said.

Det. Terry Willis, head of the LAPD computer forensics unit, helped analyze the mistress's hard drive.

"When a victim or suspect owns a computer, it's like owning a diary. Homicide investigators want to establish a frame of mind or a motive for a person before he kills or before he is killed," he said. "You'd be surprised what people will put in an e-mail that they'd never say on the phone, because of some false sense of anonymity."

Tides and porn

Prosecutors in Scott Peterson's double murder trial have submitted numerous examples of digital evidence to bolster their theory that the fertilizer salesman planned to murder his pregnant wife.

Prosecutors have relied heavily on digital evidence to build a circumstantial murder case against Scott Peterson.

Among the most damning are Internet history records from Peterson's computer, which shows that a few weeks before his pregnant wife, Laci, disappeared, he surfed the Web for information on tides and water currents in the same bay where her body turned up five months later.

Investigators often examine date and time records of computer use, satellite television viewing activity, or even credit-card purchases to confirm or refute alibis or imply a state of mind.

A satellite cable employee testified that 15 days after Laci Peterson went missing, her husband added the Playboy channel to his subscription lineup. He would cancel it five days later in favor of two "hard-core pornography" stations.

One day before a search warrant was executed on Peterson's home, he canceled his cable package altogether.

Peterson's lawyer, Mark Geragos, strenuously argued that the channels had nothing to do with the murder charges.

"What it does do is further try to assassinate his character," Geragos told Judge Alfred Delucchi, who dismissed the lawyer's concern.

"The probative value outweighs the prejudice," Delucchi said.

Mixed signals

Willis acknowledges that such electronic data can't be taken on its own as smoking-gun evidence.

"Digital evidence by itself is not as strong as you'd believe it is. There's absolutely no way you can say a particular person committed an act on a computer unless you can tie him to it circumstantially or with an eyewitness," Willis said.

His sentiments especially ring true when applied to the smart-card technology used for gaining access to a building or passing through a toll booth.

Law enforcement officials can check when and where toll-booth passes are used without notifying the owner.

"Even if you use the card, does it mean it was you who walked through the door at that time? Without a surveillance camera, can you tell he was the one to do it? No," Willis said.

The same problems exist for computer users.

"If someone wanted to use your hard drive to profile you, nine times out of 10, I could build a profile making you look like a more suspicious individual than you are," says computer forensic analyst Jeff Fischbach. "All you have to do is look in your inbox, depending on how good your spam filter is, and see what sort of info gets into your hard drive."

Trails everywhere

It should be no secret to the average citizen that every time you visit a Web site, swipe your ID badge at work, or set your TiVo to record "Six Feet Under," those actions are recorded.

Moreover, owing to the passage of the USA Patriot Act in October 2001, that information is readily available to law enforcement agencies without your permission.

As such, business has been booming for Fischbach.

"Business has grown tenfold in the past 10 years, but since Sept. 11, it's moving much quicker than before because now there's more of this information in existence and it's much easier to get," the Los Angeles-based consultant said. "On the downside, more people are being falsely charged than before."

He points to one example of a client who was charged with possessing child pornography on his computer.

By analyzing his hard drive, Fischbach was able to determine the images came from spam and pop-ups and not through any intentional effort of the defendant.

"The shame of it all was that it never needed to happen. This man was in the last years of his career and he spent his entire life savings defending himself, and nobody's going to give it back to him. His wife and kids left him. But that's what he had to pay out to defend himself against a mistake," Fischbach said.

Forensic files

How do prosecutors prove someone intended to download certain files? For starters, analysts look at where the questionable material is found on the hard drive.

"If a person has child porn stored in a temporary folder of a hard drive, it's difficult to prove whether the person downloaded it, as opposed to having a file on the computer named 'My porn,'" Willis said.

But the existence of personalized directories and subdirectories doesn't rule out the possibility of a hacker entering a computer through various remote access points.

"Leaving your Internet connection open is a lot like leaving the back door to your house open," Fischbach said. "The average person won't check to see if it's locked, but very few computers connected to the Internet are protected against someone entering."

The flipside to that is the Trojan horse defense, in which defendants claim a hacker put illegal material on their computer.

"We know systems can be compromised, so we need to figure out how you rule that out as a possibility, because the Trojan defense is something that usually raises enough reasonable doubt in a jury's mind," said associate Prof. Marc Rogers of Purdue University, who is researching ways to determine patterns of intentional versus unintentional user activity on computers.

"We look at things like Internet history files, directories and subdirectories, time of creation — if you have 70 files placed on a system within a few seconds, which indicates an automated process as opposed to manually putting in by hand," Rogers said.

Rogers said the courts are looking for guidance on this as electronic evidence continues its proliferation.

"Lewis Frier with the FBI summed it up nicely: 50 percent of FBI cases involve digital evidence. With technology being a part of everyday life, soon all trails of activities will be electronic-based," he said.

In the end, of course, the juries who weigh the validity of electronic evidence are human, which makes prosecutors like Grace hopeful.

"Everyone has gotten comfortable with concept of computers as part of everyday life," Grace said. "That will also translate into use in justice."