Remember, all you have to be is: " A SUSPECT " or a person who is " PROFILED
".
Citizen "joe 6pk" Amer I CAN/profile law enFARCEment
* Caution authorities may alter my mail

Local law enforcement
uses new high-tech tool

Retrieving 'deleted' data from suspects' computers made
easier with forensic computer and software
February 28, 2001

By LORI A. CARTER
THE PRESS DEMOCRAT

It's amazing how much information remains even after you think you've
deleted that computer file. Sometimes it's enough to help send someone to
prison for a long stretch, local law enforcement officers are discovering.


Sonoma County sheriff's detectives are learning just how valuable a good
software program can be with a new forensic computer purchased with federal
grant money.


Since it arrived a few weeks ago, Detective Mark Essick has been kicking the
tires of the 850-megahertz, 512-megabyte RAM, double-monitor machine to see
what it can do.


Detectives have copied the hard drives from suspects' computers in two
recent cases, a narcotics arrest and a check fraud and identity theft case,
and since then Essick has been scouring the data looking for additional
evidence of criminal activity.


A software program called EnCase allows detectives to retrieve deleted
files, decode encrypted data and perform in-depth searches to uncover a
suspect's trail -- without destroying evidence as they wade through it.


"It allows us to take a snapshot of the hard drive without changing the
access dates, which can be important down the road," Essick said.


If a homicide suspect, for example, says he wasn't home when his wife was
killed, but a file on his computer shows it was modified around the time the
crime was committed, his alibi won't hold water.


In other cases, photographic evidence has been the suspect's downfall.


In August, Kelly Medlock, a 53-year-old Santa Rosa man, was sentenced to 15
years to life in prison for molesting three girls. The case against him was
bolstered by erased evidence resurrected from his home computer, Detective
Dave Knecht of the Santa Rosa Police Department said.


"There were some graphic digital pictures (of his victims), which he thought
were deleted. It turns out the incriminating photos were still on the disks
we seized," Knecht said.


Santa Rosa police have been using their crime-fighting computer for about
two years.


Detectives from both departments, as well as prosecutors, defense attorneys,
judges and even criminals are learning as the field of high-tech crime
emerges.


"Until now, we've been limited on how much we could get out of a computer,"
Essick said.


"It's a whole new part of police work," Santa Rosa Police Cmdr. Scott
Swanson said. "The tool of choice for the criminal in the future is going to
be the computer, because that's where the money is."


Although so far in Sonoma County, computer evidence has been discovered
mainly in sex-crimes cases, all manner of crimes can leave a cybertrail.


Sheriff's Lt. Bruce Rochester said his department will use the computer to
track down data on chemicals used in environmental crimes; on violent crimes
in which someone has possibly written a "hate list" or sent threatening
e-mail; in property crimes such as fraud, identity theft or embezzlement;
and for narcotics cases in which suspects keep financial records.


Computers also have yielded critical evidence locally and nationally in
cases of hacking, terrorism, militia activities and espionage, as in the
case of Wen Ho Lee, a nuclear code developer at Los Alamos labs who copied
nuclear secrets and was suspected of leaking them to China.


In one current Sheriff's Department case, Essick is putting together
evidence against a woman arrested for check fraud. She is suspected of
creating fake checks, fake IDs and a driver's license in another woman's
name on her computer.


The case started with a simple report of mail theft. The victim lost about
$6,000 in the ordeal.


As part of a different grant, the Sonoma County district attorney is
participating in the North Bay High Technology Crimes Task Force with Marin,
Solano, Napa and Contra Costa county offices. District attorney's
investigator Ed Hudson will work at least part time helping prepare computer
data cases for prosecution.


Detectives have had to be careful in documenting whether there is probable
cause for a detective to be snooping around in someone's personal
information.


"It's like looking through a diary," Essick said. "It is personal, but
that's why the courts and case law has required a second search warrant for
computers" in addition to a warrant for the residence.


Santa Rosa defense attorney Chris Andrian said he has been impressed with
the information-gathering capabilities of the computer systems, and of the
investigators.


"If the technology is there, it should be made available to people, but it
should only be used when warranted, and not without a court order," he said.
"We're all in process of learning about this."


You can reach Staff Writer Lori A. Carter at 521-5205 or e-mail
lcarter@pressdemocrat.com .

joe 6pk