Preserve Electronic Evidence, Preserve Justice
For the last decade, electronically stored information (ESI) has been an increasingly dominant source of evidence in civil litigation as business communication has shifted to electronic media. But the as the heart-wrenching investigation into the death of Caylee Anthony continues to unfold, it demonstrates that the value of ESI is no longer relegated to the world of civil litigation.
In any investigation, evidence is collected wherever human interaction occurs. As electronic communication has become increasingly personalized, intimately personal conversations now commonly take place over once highly impersonal media such as text messages and social media networks. For criminal investigators, this makes the preservation and collection of evidence from electronic media as critical as that of physical evidence from the crime scene itself.
In the ongoing, highly sensationalized trial of Casey Anthony, investigators and criminal prosecutors are using ESI to demonstrate everything from event timelines to intent and motive. Following the arrest of Casey Anthony in the investigation into her daughter’s disappearance, law enforcement in central Florida seized and forensically searched electronic devices ranging from cell phones to digital cameras. The investigation revealed a trove of electronic evidence that has proved vital to the prosecution’s case.
Photographs and their metadata, extracted from seized digital cameras, have helped piece together the mysterious timeline surrounding Caylee’s disappearance, while e-mail and chat conversations have been presented to help elucidate motive and intent. Perhaps the most damning of all, forensic investigation has revealed a list of internet search terms and the web browsing history from around the time of Caylee’s disappearance. Searches for words such as “chloroform” and “head injuries” were discovered by reconstructing deleted internet history files from the hard drive of Casey Anthony’s computer. This was done by forensically imaging the computer’s hard drive, and then analyzing the unallocated, or “slack space” for information marked for deletion. Unbeknownst to the layperson, and to the dismay of the would-be spoliator in this case, simply deleting information from the operating system does not permanently remove data. Instead of actually overwriting the information, deleting data only causes the computer to designate it as overwrite-able. Furthermore, because deleted data is broken up into bits and pieces spread all across the hard drive, it can take a considerable amount of time until all of the information is completely lost. A skilled forensic investigator can quickly analyze storage media and retrieve this information from the slack space.
When collecting any ESI, and deleted data in particular, time is of the essence and the skill of the forensic investigator is critical. Like other forms of trace evidence – such as blood, fingerprints, tire tracks, etc. – electronic evidence is extremely fragile; the slightest inconsistency in the preservation and collection process can render even the proverbial “smoking gun” wholly inadmissible. Preventing this requires the use of highly skilled and experienced forensic investigators who can properly preserve ESI and collect all the relevant data while maintaining a strong chain of custody and ensuring the defensibility of the evidence at trial.
Cases like the Casey Anthony trial illustrate both the growing prevalence and vital importance of ESI in the criminal context. Every trial directly depends upon the quality of evidence presented. If justice is to be ensured as we continue moving deeper into the era of electronic evidence, criminal attorneys must quickly begin taking cues from their civil counterparts and learn how to effectively manage ESI.