Computer / Digital Forensics in Criminal Defense

   Unlike many firms and individuals in the field of computer/digital forensics, IT Forensics, Inc. does criminal defense work.   In the world of computer forensics there are many former law enforcement officers. Many of these veteran officers, though generally well-trained, capable, honest and having good intentions, have developed a good guy/bad guy mentality and regard computer forensics as a secret society where they don't want the "bad guys" to know their secrets.

    Defense lawyers are often seen as aiding the bad guy. Forensic examinations are the pursuit of the truth, the empirical facts, and facts don't take sides, they just are. We believe, "Your client has a right to the whole truth."

    In many cases we utilize the same tools as the prosecution, but we have alternative tools available and many times we use better (more complete) methodologies and look deeper than government examiners. Different tools have different strengths and weaknesses, and looking with a different tool may reveal information not revealed by another tool.

    The nature of the crime charged should influence the questions that the digital forensic examiner is asked to answer. We have an attorney on staff, who is an experienced computer forensic examiner to assist in framing questions for our forensic examiners, and if needed to assist in framing questions for the government's examiners. Government examiners are not looking for exculpatory evidence, virtually all of them would if they found it, include it in their report, but if they don't look, they may never find it, and if they do find it, they may not register its significance.

    We look for the alternative paths in situations, that often don't occur to the government's examiner or the prosecutor. We handle cases involving a wide variety of criminal defense matters including allegations of possession and trafficking of child pornography (e.g. State of Washington v Bajwa), terrorism (e.g. U.S. v Hussein, District of Idaho).

    We don't rely on the services of one examiner to do everything, but rather we are a team. Each person on our team has general computer forensic training and experience in computer/digital forensics, but they also have a specialized set of skills developed over years of practice targeting some aspect of the broader field of what is now called digital forensics.

Today not only will evidence be found on the hard drive of a desktop or notebook computer, but it may be stored on any number of other devices or systems including, but not limited to: an external hard drive, a network drive, a flash drive, a digital camera, cell phone, Personal Digital Assistant (PDA), e-mail or on a web based backup service. Each of these devices has its own challenges, and with cell phones and PDAs each model may have unique characteristics starting with the type of connector required.

Poorly-trained experts rely on software tools without much understanding of how they work. Of course, all of us trust and swear by tools we don't fully understand, but an expert should be able to at least explain in a general way how a tool works and not just offer it up as a black box from which answers spring. A great tool in unskilled hands is not reliable.

We believe "Your client has a right to the whole truth"