Plea or Trial (Part 4 – section 2 of 2)

So what now?!?! You’ve got your FULL DISCOVERY, what are you supposed to do with it? Simple – it goes to a professional forensic investigator.

In this post I will show you some examples of evidence tampering and procedural malfeasance. Any lawyer worth their salt will tell you that showing procedure violations is the best defense. The rules are in place for a reason, use them! The cops have no qualms breaking rules, planting evidence, and making wild inferences and accusations – regardless of what such actions will do to a persons life and the lives of their friends and family – why should we be the only ones with a moral compass?

We assume the cops are telling the truth even after we find out what they are doing, why?? Let me show you what your lawyer alone can’t find – then you tell me if you think there is no need to run a forensic investigation on your digital confiscated files.

Let’s start with what the police are trained to do – proper handling of your digital files begins the moment the devices are surrendered. In most cases that’s a cell phone. In many cases the police will come to the arrested person’s house and take a desktop or laptop as well. Regardless the rules are the same.

A test on a cell phone may be run immediately upon arrest to prove that the arrestee was in fact the person communicating with LE. After that all devices are to be put on airplane mode so as to not interact with the internet or other devices. Under no circumstance should a device have any modifications, uploads, downloads, new data or data deletions after confiscation. It’s pretty simple. The device should look exactly as it did the moment LE took possession – if not – that’s evidence tampering! Grounds for dismissal, or at a minimum sanctions for spoilage of evidence.

As I mentioned – some lawyers will try to convince their clients that they are qualified to go through the data forensically. That they have done these cases and know what to look for…and to a small extent that’s true. By all means, your lawyer should look through the data and find any inconsistencies, as well as grounds for your defense.

But know this, we went through an entire trial without our lawyer mentioning (or noticing for that matter) manipulation within our texts. Here is one example:

Now this is hard to read, it’s small, but let me give you the jest. The texts consist of headers…and then a message presumably sent by the person named within the header above the text. In this particular context, my son Jace is telling the adult to ‘forget sex’, that he wants to come play video games with her.

Her reply, according to the texts, is “I’m a 20 year old white guy…” followed by her also then saying “I’m 13 and this alien is fukin tearin me up’.

Clearly a message was deleted or moved within these texts, and it doesn’t really matter what, or to where, as long as you can show they have been manipulated. The officer will need to explain how this happened and how they can be sure there were not other manipulations to the data. This will show doubt to a jury or even just the prosecutor if you are leaning toward a plea deal – very valuable!

Lets look at a more aggregious manipulation. And let me preface this with there is no way your attorney could find these examples:

Granted, these are hard to see… the first screenshot shows a data extraction file with it’s date/time stamps for when it was created, last accessed, and last modified. Remember me telling you there are to be no altercations to extraction files? The last modified date of that file is two weeks after the file was created!

The next example shows a log file from a full file extraction on an Apple IPhone. Within the log file, you can plainly see (if it was bigger) where someone merged and inserted data. Do you think LE would want to explain that on the stand?

And the last screenshot shows where an officer, on a confiscated device, logged onto a message board and downloaded CP to the device! I guarantee you that your lawyer is not capable of this level of digital forensics, and that showing such evidence in court would do more than merely afford some doubt.

I know, for a fact, that the officers who took the stand in my son’s trials not only manipulated the evidence but outright lied. It took me by complete surprise in our first trial, as it would likely surprise all of us who grew up believing police officers were moral, upstanding public servants.

If we know they will lie on the stand – why would we think our digital evidence is safe in their hands?!?

Get a professional digital forensic analyst!