For those unfamiliar with the case of Jodi Arias in Arizona, she was arrested and later found guilty of the murder of Travis Alexander in 2008, she is currently facing the death penalty. The nitty-gritty of the case aside, the defense hired a computer forensics expert to examine a computer that belonged to the victim. They found that "thousands of files", which mainly consisted of pornography, had been deleted from the computer while it was in the custody of the Mesa Police Department in July of 2009 over the course of a few hours. Neither the Maricopa County Attorney or Mesa Police have made any comments regarding this development. Why is this relevant? The prosecution has portrayed the victim as a devout Mormon and Arias as a sexual predator, and Arias in her testimony claimed that she had walked in on the victim viewing pornographic photos of young boys. This part of the case is a "he said, she said" situation, as the physical evidence to back these claims up (specifically letters from the victim to Arias) could not be verified.
This case aside, is it possible that someone altered this evidence? Of course, it’s possible, but we may never know for sure. It could have happened in the custody of the police, it could have occurred with the computer forensics expert, it could have taken place before the murder was committed, any of these situations is possible. Either way, if these allegations are proved to be true, whoever is responsible for the misconduct will have a lot to answer for. That person will probably lose their job and all credibility they have, the conviction against Arias could get overturned; it is a real mess.
Digital Evidence: Standard of Care.
When looking at digital evidence, it is important to always make a copy of it. A digital investigator should rarely if ever examine the original evidence. Examining "Mirror Images" or "Bit by Bit Copies" of the digital data preserves the original evidence as it was found. These protocols have been upheld in courts across the country and goes to protect not only the plaintiff and defendant but also the investigator from accusations of tampering, such as these.
Computer Forensics Expert Witness: Integrity is Key
As computer forensic experts, we have a duty to report the truth and nothing but the truth. It is not our job to pass judgment or make things up for our clients. Any of these will see us out of business very quickly, with no hope of ever returning to this field. You can learn the ins and outs of forensics and how things work, but you can't learn integrity, and this is what we bring to our work.
