Post Process

Everything to do with E-discovery & ESI

A Tug of War over Forensics Applications and Formats

Posted by rjbiii on December 16, 2009

From two different blogs, we read of a fascinating criminal case involving a tug of war over evidence. Ultimately, the main points made by both the prosecution and defense missed the mark. A little knowledge could have gone a long way.

We begin by browsing over to Law Professor Susan Brenner CYB3RCRIM3 blog, to a post entitled Encase v. Ghost. Here she describes the case of State v. Dingman, 149 Wash.App. 648, 202 P.3d 388 (Washington Court of Appeals 2009), where a construction contractor specializing in building sunrooms was given a large deposit and money for materials, but who allegedly never finished the job. At trial, Mr. Dingman was convicted of 16 counts of theft and 11 counts of money laundering. He appeals. Why?

Because of the tug of war over evidence residing on his computer. Prior to trial, Dingman requested access to the files on his computers, which were seized by the state and still locked up. The state evidently made Encase images available to the defendant, but that wasn’t good enough. Why?

According to testimony, neither the Dingman legal team nor their forensics expert possessed a copy of the EnCase application (they thought) necessary to read the image. And Encase costs over $3,000 and required another $1,500 for training, according to Defendant’s expert. The State should, as they had in the past, provide a copy of the hard drive in a non-Encase format. Even better, allow the Defense to use its own tools to image the drives themselves. Ghost was specifically mentioned as the Defense’s tool of choice. The State objected. Why?

Evidently, the State believed that the Hard Drives could be damaged should they be released from custody, and that Ghost might produce an inaccurate copy. The States expert noted that he had a copy of Ghost, but did not use the tool for forensics. The State also argued that it didn’t need to “conform” its investigation to the “whims” of the defense, and that the Encase images had been happily accepted by all other defendants prior to this case. The trial court denied Defendant’s motion, and ordered the Prosecution to provide Encase images to the Defense.

After receiving a continuance to allow Defense the time to examine the drives, the trial court refused to grant a second, despite the Defense’s assertion that it had only been partially successful in reviewing the evidence. The Defense and their expert had only been able to access two of the nine drives, and on those two encountered files that it could not open. The trial continued, leading to the conviction of Mr. Dingman on several charges. Of course, we are not done. Why?

On appeal, the higher court cited a Federal district court decision stating that a defense expert should be able to “`utilize his or her hardware or software.'” The prosecution had not established for appropriate restrictions necessary to limit discovery in the manner occurring in the instant case. The Court of Appeals continued by holding that the lower court had “erred by requiring that the State provide only an EnCase mirror image of Dingman’s hard drives to the defense.” The State Supreme Court declined to review the opinion, and Mr. Dingman gets a new trial, should the state decide to a mulligan.

There is plenty wrong here. A lack of knowledge, and of collaboration, has cost the state a bit of money, time, and perhaps secured the liberty of someone who may not deserve it. Rather than lay it out here, however, I’ll direct you to Craig Ball’s commentary, where he does a fine job of discussing all of the issues. His post is called Stubborn v. Stupid.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: