Computer expert witness discusses computer forensics

A forensic computer architecture expert witness for the defense discusses computer forensics, information security, computer science, and internet security as it pertains to temporary internet files. This case involves a man and his wife who had a strained marriage. They argued a great deal, sometimes publicly. One morning the wife went for a run and did not return. Two days later, she was found strangled in a lot near their home. Police suspected the defendant, and he vacated his home so it could be preserved as a possible crime scene. When he left, he left his laptop computer turned on. It was on for two days before police seized it. Two computer electronics analysts for the state concluded that the temporary internet files recovered from the laptop indicated that someone conducted a Google Map search on the laptop on the afternoon before the murder. The state said this search was done on the laptop from the defendant’s home. The person initiating the search entered the zip code for the defendant and then moved the map and zoomed in on the exact spot where the body was found.

A trial court excluded most of the testimony from the defendant’s computer security/data storage expert. A jury convicted the defendant of murder and he appealed.

Question(s) For Expert Witness

Is it possible to show that temporary internet files have been planted on a computer?

Expert Witness Response

The defense expert worked for more than 15 years in the computer field, specializing in computer network security and investigating employees’ use of the internet. He has numerous certifications and has published articles on data security. Using the same technology he employs in his job, he examined the temporary internet files and determined that the files in this case had been tampered with.

The state appeals court concluded that the trial court erred in finding that the defense expert witness was not qualified to testify as a computer forensics and cyber crime expert because he was only a computer security expert. Because the digital forensic testimony was the only evidence against the defendant, the panel ordered a new trial.