Knowledge truly is power. However, knowledge when it comes to e-discovery means knowing where the information is and how to use or access it. Electronic discovery remains a complicated and often costly issue.
This blog will take an objective look at Ediscovery trends litigation support and without warning will veer off into personal observations and themes.
Keith L. Jones of JDA wrote this informative and excellent piece:
Computer evidence was introduced into the highly publicized trial where mother Casey Anthony has been accused of first degree murder for the death of her toddler, Caylee Anthony. Three computer forensic experts were used by the prosecution: Detective Sandra Osborne, Detective Sergeant Kevin Stenger, and Mr. John Bradley. I also expect the defense team to have a computer forensic expert or two in order to dispute the evidence presented against Casey Anthony, as so far it seems to be the only evidence I have seen that could show premeditation. In a series of blog articles I hope to discuss the computer evidence and the use of expert witnesses in the context of this trial......
During his live testimony in front of the jury, Bradley went through the detailed Cacheback report line by line and discussed the Google searches a user at the computer conducted. Bradley also discussed the articles viewed as a result of the Google searches, such as articles found on Wikipedia. Some of the searches and article titles accessed by the user at the computer consisted of:
Hand to hand combat
Middle meningeal artery
The user at the computer also visited Facebook, MySpace, and PhotoBucket, which were accounts Casey Anthony also reportedly frequented. In addition to the searches listed above, the prosecution focused on the searches and article titles containing the following phrases:
How to make chloroform
Making weapons out of household products
On cross examination the defense attorney zeroed in on the bug in Mr. Bradley’s software that originally brought him into the case. During cross examination Bradley also testified that he was not paid by the prosecution for his testimony. Bradley made a statement that there were discussions about payment by the prosecution, but it would be worked out after the trial and he was not there for the payment. The defense attorney then asked Bradley about the time difference between the user browsing the chloroform content and then browsing other subject material not related to chloroform. The period of time was approximately three minutes, according to Bradley and the Cacheback report he read from. The attorney then asked Bradley if three minutes was the longest time the user at the computer could view this particular chloroform material. Bradley answered that he was correct.
On redirect examination, the prosecution used a line of questioning that may have been headline of the computer forensic testimony in this trial. Bradley testified that it was recorded in the internet activity that the web browser had visited one particular website that potentially contained content about chloroform at least 84 times. A user visiting a website at least 84 times could show that the browsing was not accidental.
In case you were wondering, the defense attorney attempted to establish that Bradley was unable to determine which physical person was sitting at the keyboard in front of the computer and browsing this content. This is a common line of questioning because, in general, it can be difficult to determine which person initiated activity without additional information. Such additional information could be the act of logging into specific accounts belonging to a person, or perhaps the computer user knowing something only one person could know.
This was the end of the testimony on the first day. Personally, I disagreed with Bradley’s testimony about the user browsing chloroform content for only three minutes. I do not believe you can have that opinion, given the facts. For example, Firefox version 2 had support for tabbed browsing and the user could also open multiple browser windows. Every time a user visits a new site in a new tab or browser, a new entry is made into the internet history file (or the “visited” counter is incremented). Firefox version 2 internet history files will not record the time a browser or tab is closed, or when the subject matter can no longer be viewed by the user. I feel the defense attorney was trying to demonstrate that the user could not possibly have enough time to read about “how to make chloroform”, but in reality, in this case, it seems as if we are unable to tell how long the material was available to the user on the screen. However, Bradley did state that the article for chloroform was visited 84 times by a user on this computer. I believe this is strong evidence to support that a person had been reading the material numerous times in the past, and the amount of time the user spent reading about chloroform could not be accurately established with the data used in Bradley’s testimony.
The next morning Bradley finished his testimony. I was happy to see that the prosecution finally asked Bradley about tabbed browsing and if multiple tabs could be open. They also established that Bradley was unable to give an opinion on whether or not a web page could have been printed out. Although there are some artifacts in Windows that could potentially show that a web page was printed out, Bradley only had access to the one 3.2MB Firefox history file. I believe the door was left open to assume that the user could have printed the chloroform web pages to review at a later time. Mr. Bradley was excused and the trial continued with other witnesses not as relevant to the computer evidence. The only additional noteworthy testimony came from Casey’s brother who said he did not delete the internet history manually on that computer system and did not recall surfing to those sites in that timeframe.
Although potentially technically strong, I believe that the prosecution’s presentation of the computer evidence in this trial may have downplayed its potential importance. All three expert witnesses either read from their law enforcement report or from the output of a tool designed for computer forensic examiners, not jurors.