It’s recently been reported in the news that the Florida sheriff’s office, who had been working on the Casey Anthony case, had overlooked some potentially crucial Google searches which could have been used as evidence.
So the question becomes – how were these internet history artifacts missed? Well, apparently investigators had found artifacts from Internet Explorer, but did not bother to look for similar files for alternate browsers. It turns out that the browser Casey Anthony preferred was Mozilla Firefox, and that browser’s internet history was not thoroughly searched. If you read the article further, you’ll see that Anthony had retained a computer expert who was prepared to answer questions about the searches, but the questions were never asked by the prosecution.
This is why hiring a competent, experienced computer forensics expert can make or break your case. Each case involving a computer (or other digital device) is unique, and users often use computers in slightly unique ways. When an expert can analyze a hard drive (or set of files), new information can be gleaned and be used to confirm or deny suspicions about the user.
Patterns can also be discovered about how the computer was used, even without traditional login information. For example, if one set of login credentials (ID and password) was provided to log into a computer, but another user’s webmail/Facebook/Dropbox credentials were used to log into that service, we can ascertain that one user is likely impersonating another. We can combine this information with other info, such as past web-surfing habits, timestamps, and IP address history to help create a timeline of events.
The complexity of the services and devices we rely upon will only increase in the coming years. Call a computer forensics expert when it’s time to track down the information that is most important to your case, even if you don’t know if it exists or not. A Google search, a photo taken with a smartphone, or a text message can all appear to be “deleted” to the untrained eye – make sure you do all you can to find out if that data can be recovered.