linux operating commands and unix operating commands

A Mistaken Conviction Based on Digital Forensics – Part 1 – Pretrial


 
Thread Tools Search this Thread
# 1  
Old 01-15-2009
A Mistaken Conviction Based on Digital Forensics – Part 1 – Pretrial

Most of us watch criminal cases in movies and on television where forensic evidence ices a conviction and exonerates the innocent.  How is it possible that someone can be convicted based on forensic evidence when they were not guilty?  Let's examine a modern day case where this occurred:

·         The event took place on October 19th, 2004

·         The accused was tried and convicted on January 3-5, 2007

·         The sentencing was scheduled for eight weeks later, March 2nd, 2007, then delayed until

o   March 29th, 2007 which was postponed on March 28th, 2007 until

o   April 26th, 2007 and finally heard on

o   June 6th, 2007, a motion for a new trial having been submitted the preceding day by the defense.

·         A new trial was ordered on June 6th, 2007

·         On November 21, 2008 the case was finally disposed of, but justice was not served, with a plea agreement of $100.00 fine and loss of her state teacher's license.

Taking a look at the case from 50,000 feet, or perhaps higher, the accused encountered a “pornographic” popup storm on her computer in the classroom.  Her failure to turn off the monitor or take other sufficient action to preclude her students from viewing the popups resulted in her being charged with “risk of injury to minor” tenfold.  Forensic evidence developed by law enforcement indicated that the accused willingly chose to view these images and neglected to protect her students.  While the defense had a competent forensics examination witness, he was not allowed to testify.  She was convicted but sentencing never took place as the court was convinced of flaws in the prosecution's presentation which possibly mislead the jury and ordered a new trial.  After waiting 18 months a plea agreement was reached and the case concluded.

For those not familiar with the case the accused was Julie Amero and an Internet search on her name will keep you busy for weeks, perhaps months, with the results offered.  A check of Google today produces more than 65,000 responses.  I have maintained a daily Google search for more than a year which provides only “new” entries found on the web.  There continue to be new postings almost daily but unfortunately most are exploitation rather than having content meaningful to her case.  I will endeavor to provide a meaningful report from the forensic perspective including related trial procedural errors.  I have been close to the case for one year and aided in her defense post conviction.

Obviously, much of what I write will be based on personal experience and/or observation trying to maintain focus upon those actions/events which contributed to the original conviction as well as the actions taken to have the conviction set aside and a new trial ordered by the court.  Some of you may wish to see nuts and bolts, soup to nuts detail.  Immediately, I offer you a copy of the trial transcript.  As you might guess, it is sizeable, 1.8 MB in PDF format.  Later, I will provide other detail but, at the moment, I do not want to get off topic.

From the beginning this case was a forensic nightmare.  The PC was running Windows 98 with an anti-virus which had expired some four months prior to the event.  Julie was quite computer illiterate barely knowing how to communicate with her husband via eMail.  However, attendance was taken on each teacher's classroom PC and was uploaded periodically to the local server.  Substitutes are not provided logon IDs; rather, a staff member completes the logon and instructs the substitute not to logoff or turn off the computer.  At least once when Julie left the classroom she found several students at her PC giggling when she returned.  Assistance was sought but none was ever forthcoming.  The PC remained in the classroom being used for a few days after the incident before it was taken out of use and later a “forensic” image taken.

To a competent defense attorney the details above should be sufficient to have all of any forensic evidence thrown out of court; in fact never allowed to be presented, rather stopped during pre-trial discussions.  However, this did not happen.  In “Part II - The Trial” I will examine what happened.  Should you choose to read the transcript immediately, please withhold any questions regarding the trial until that segment is posted.  On the other hand, please post any questions or comments about this segment and I will endeavor to respond promptly when appropriate.

Image
Image

More...
Login or Register to Ask a Question

Previous Thread | Next Thread

3 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Discard part of a file based on a pattern ---

I have the file: s3_T0(2) Pos "1" "2" s1_T1(2) Pos "1" "2" --- 0 0 1 0 0 1 1 1 --- 1 2 "tau0" 1 2 "h10" I want to patternmatch on --- and get only the third part i.e. 1 2 "tau0" 1 2 "h10" I wanted to start simple but even something like (5 Replies)
Discussion started by: eagle_fly
5 Replies

2. Filesystems, Disks and Memory

Recover a mistaken swap-formated USB-HD

Hi! Installing the debian wheezy by netinstall my external USB-HD (2TB) is erroneously completly formated as swap-filesystem. I was to lazy to disconnect the USB-HD, so now i could kick myself . Is there any chance to rescue the data. I tried to find a way by using gparted: the whole HD is... (3 Replies)
Discussion started by: IMPe
3 Replies

3. UNIX for Dummies Questions & Answers

Removing Part of a variable based on a pattern

Hi All, I am writing a script to work with files in a folder. The files are all in the following patterns (without quotes): "some filename - NxNN - the end.YYY" or "some filename - NNxNN - the end.YYY" Where N = a single number and YYY is the extension. Basically what I want... (5 Replies)
Discussion started by: sgtbobie
5 Replies
Login or Register to Ask a Question