Forensic Analysis of Computer

Colorado Computer Crimes Criminal Defense Understanding Computer Forensics – Criminal vs Civil*

In the field of computer forensics, as in the field of law, procedures in civil cases differ somewhat from those in criminal cases. The collection of data and presentation of evidence may be held to different standards, the process of data collection and imaging can be quite different, and the consequences of the case may have very different impacts.

A couple of quick definitions may be in order. Criminal law deals with offenses against the state – the prosecution of a person accused of breaking a law. Such offenses may of course include crimes against a person. A government body, or the representative of a government body accuses the person of having committed the offense, and the resources of the state are brought to bear against the accused. Guilty outcomes can result in fines, probation, incarceration, or even death.

Civil law covers everything else, such as violations of contracts and lawsuits between two or more parties. The loser in such a dispute often must give payment, property or services to the prevailing party. Imprisonment is not at issue in civil cases. As a result, the standard for evidence is not as high in civil cases as in criminal cases.

For the law enforcement computer forensics specialist, a certain amount of extra care should be taken in collecting data and producing results, for the standard of proof is higher. There are advantages on the data collection end, however. For once a court has authorized a search warrant, an officer (and possibly several) with badge and gun can go seize the defendant’s computer by surprise and by force. Once the computer has been seized and imaged, all data is accessible and may result in additional charges being brought against the defendant.

By contrast, in a civil case, there tends to be a lot of negotiation over what computers and what data can be inspected, as well as where and when. There is not likely to be any seizing of computers, and quite a long time may take place between the time the request to inspect a computer is made and the time the computer is made available to be inspected. It is common for one party to have access to a very limited area of data from the other party’s computer. During this time, a defendant may take the opportunity to attempt to hide or destroy data. The author has had several cases wherein the computer needed for analysis was destroyed before the plaintiff had the opportunity to inspect. Such attempts at hiding data are often discovered by the digital forensic sleuth, who may in turn present evidence of such further wrongdoing in expert witness testimony.

Opportunities for learning techniques and interacting with other professionals may differ as well. While some computer forensic software suites and training, such as Access FTK, EnCase, or SMART Forensics are available to most who can pay, others, such as iLook are available only to law enforcement and military personnel. While many support and professional organizations and groups are available to all, some, such as the High Technology Crime Investigation Association (HTCIA) are not open to professionals who provide for criminal defense (with a few minor exceptions).

When law enforcement has a case involving computer forensics, the intention is to locate enough data to find the defendant guilty in court, where the standard for information presented tends to be fairly high. From the time digital data or hardware is seized and acquired, Rules of Evidence must be kept in mind (Cornell University has the complete and voluminous code on its website). Law enforcement personnel must follow accepted procedures or evidence could be thrown out. Acquisition of data and discovery in criminal cases often must follow sometimes strict and differing procedures depending upon whether the jurisdiction is federal, state, or municipality and at times depending upon a judge’s preferences.

In a civil case, the initial processes of electronic discovery may be just to find enough data to show one or the other party whether they are likely to prevail, should the case go all the way to court. As such, the initial presentation of data may be fairly informal, and be just enough to induce the parties to settle the case. On the other hand, the data found may be so minimal the line of inquiry into electronic evidence is dropped.

Although we use many of the same tools, computer forensic professionals in private practice and those in law enforcement are held to different standards, have access to different resources, and their work results in substantially different outcomes between the criminal and civil cases to which they contribute.

* Credit for this article is given: Computer Forensics Criminal vs Civil What's the Difference?

Client Reviews
★★★★★
"Mr. Steinberg provided my family with expert handling of my son's case. He took extra time understand the case, to consult with us during the pretrial proceedings, and to support him for a plea agreement. Mr. Steinberg is very knowledge about the law and very professional. He guided us in achieving the best possible outcome for my son. If I am ever in need of law services again, I will certainly have Mr. Steinberg handle my case. l also highly recommend his services to anyone that might be in need of an excellent defense attorney!" Tanya Witt
★★★★★
"I found myself in criminal trouble, that I wasn't guilty of and thanks to Mr. Steinberg's dedication and hard work, right before we we're looking at having to continue on to trial level Mr. Steinberg was able to use his vast knowledge of the law and his many respected years in the system to find a way to show my innocence. After a very unsure and somewhat difficult time for me, this very skilled and knowledgeable attorney was able to find the right path to take to reach a dismissal in my case. For that I can't tell you how much I appreciate his representation and his excellent understanding and helpful personality. He's a great man and an even better attorney but don't misunderstand him, he is an attorney not a therapist. Thanks H." Josh
★★★★★
"Working with Michael Steinberg was a wonderful experience. Truly people need to know that he is a expert in what he does. His personality is compassionate, intellectual, and down to earth. I glean that Michael is fun to be around. In the time I worked with him, it was a pleasure to be around him. As for my case, the outcome was amazing and couldn’t be better. He has made my life more manageable because of the outcome of my case. I’ve worked with other lawyers in the Denver area. He is superior to them all. If you’re in need of a lawyer and you come across Mr. Steinberg look no further he’s going to be the one you need. Thank you again Michael." Renee Taylor
★★★★★
Mr. Steinberg, It has been an honor working with you. I very much appreciated your style, demeanor, patience, and determination. I was well instructed in every step of the court process, and I felt that I received excellent guidance and timely information regarding my case. You have been extremely thoughtful with your time, and I was very impressed with your sensitivity in responding to my requests. Thank you. Anonymous