Even though the protocol and process a computer forensics investigator uses to extract and analyze data from a computer are the same no matter who owns the computer, ownership does make a difference in the outcome once the facts are uncovered.
For one thing, the owner of the machine has to provide appropriate permission for the computer forensics investigators to access data on the device. What the users are allowed to do on the machine also comes into play depending on whether the computer is owned by a private individual, a corporation or a municipality.
For example, had a case where our computer forensic experts were asked to extract data from a computer owned by a municipality. An employee was suspected of using municipal funds in the wooing of a co-worker during their love affair. In the process of the forensic computer analysis, we uncovered pornography on the computer.
Because computer forensics investigation is an objective process, when the computer forensics analyst turned over the data extracted, the pornography was also included.
In this case – and others like it – the computer forensics expert treats the data extracted as factual data. There is no judgment made as to what to include – or what to omit. It was all requested and it was all provided.
Not only was there evidence to show misuse of funds, but the computer forensics analysis resulted in additional charges being leveled because the employee was not allowed to access pornography on municipal computer equipment. If the user had accessed pornography on his own personal computer that would not have resulted in charges (unless it was child pornography, which is illegal and must be turned over to the authorities).
Who owns the computer, what it is used for and what users are allowed to do on it matters. However, once the computer forensic investigators have the appropriate permission to access the data, we report facts and the rest we leave up to the attorneys, the authorities and the clients.
-Brenda McGinley, CEO, All in Investigations, All in Investigations
