TABLE OF CONTENTS J.J. McLean
In October of 1998, I was assigned as the police supervisor/investigator for the Attorney General's High Technology Crime Unit (HTCU) in Boston, Massachusetts. During this assignment, I received a call from a State Police homicide unit from a nearby county. They asked for my assistance in the safe seizure and subsequent examination of computers for evidence relating to a recent double homicide. The specific digital evidence that we were searching for was a series of e-mails that were exchanged between the victim and the assailant and others. These e-mails contained evidence that was crucial as to the motive in this case. I agreed to assist them and accompanied them to execute our search warrant.
This case demonstrates a number of valuable lessons. Obviously, when networks are involved, evidence can be distributed on a number of computers. Therefore, it may be necessary to perform an initial onsite search to determine which computers contain evidence and should be collected for offsite examination. As demonstrated in this case, when investigators are authorized to search one computer on a network, they may be permitted, without separate authorization, to search portions of remote systems that are connected to the primary system. However, when evidence of another crime is encountered, great care must be taken not to abandon the initial search and perform an extensive unauthorized search for evidence related to the second crime. This case also demonstrates several useful evidence examination and presentation techniques.
During the execution of this search...
