Monday, March 06, 2006

Reader Inquiry on Computer Forensics

A reader has posed the following inquiry:
The government has charged an individual with possession of CP. In the initial search for data, "standard" forensic tools (Encase, iLook, etc.) were used to no avail. Afterwards, a "secret" tool called Quincy was used to supposedly find data that was unable to be found by the other tools. Quincy supposedly only "located" data (which was in unallocated space and which had been deleted and in a state completely unretrieveable by other than forensic tools used by experts) and then the other tools were used again to retrieve the data which was "located" by Quincy. Should the evidence be suppressed based on the fact that Quincy is so secret that nobody outside of a few law enforcement/government types have verified its reliability and/or accuracy? Does anyone have any thoughts on this? I'm very curious.
Our own take: Because the Quincy tool was used only to locate the data, which was retrieved, once found, by other means, it's not clear that anything involving Quincy need even be offered in evidence. If a psychic tells the police where to dig, and if, on digging there, they discover the shallow grave, then they have found the corpus delicti. There's no requirement that the reliability of the psychic's methodology pass Daubert muster.

Care to add yours?

0 Comments:

Post a Comment

<< Home

Fed. R. Evid. 702: If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, if (1) the testimony is based upon sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case.