Forensics Journal - Stevenson University 2011 | Page 30

STEVENSON UNIVERSITY

Computer Forensics and Child
Pornography Investigations
Danielle Sutton
Computer forensics can be utilized in a wide variety of ways to investigate computer crimes, resulting in innovative investigative and prosecutorial issues due to the unique attributes of computers. The growth
of the information age and the internet has led to a dramatic increase
in internet usage by child pornographers, making it easier to create,
access, and distribute child pornography using digital media. Child
pornography cases can be difficult to investigate; however, computer
forensics plays a key role by assisting in the successful prosecution of
perpetrators as well as protecting those wrongly accused of creating,
accessing and distributing child pornography.

Various sources report that at least 80% of all computer crime cases
involve child pornography (Wells et. al., 269). “Child pornography
is prohibited by federal statutes, which provide for civil and criminal
penalties for its production, advertising, possession, receipt, distribution, and sale.2 Defined by statute as the visual depiction of a minor–a
person less than 18 years of age–engaged in sexually explicit conduct,3
child pornography is unprotected by the First Amendment, as it is
intrinsically related to the sexual abuse of children.”
Computer forensics is used to preserve and extract the electronic
data found in server logs or on the hard drives of the confiscated
computers. Every entry on a computer is captured in the server log or
hard drive like a piece of a puzzle; the forensic investigator’s job is to
connect the pieces to solve the puzzle. Forensic investigators specialize in recovering, analyzing, and presenting data from computers for
use in investigations or as evidence. The forensic investigator’s duties
entail “confiscating computers, determining the details of intrusions
into computer systems, recovering data from encrypted or erased files,
and recovering e-mails and deleted passwords.”4 Investigators use both
traditional and undercover tactics to investigate child pornography
cases. According to Liberatore, Levine, & Shields (2010), the forensic
investigator is used to link observed criminal behavior on the network
with evidence of that behavior on a specific machine.

Child pornographers no longer use print photographs, videotapes,
and magazines as their preferred mode to distribute child pornography images. The internet has become their primary means for
communicating and sharing illicit images. Child pornographers’
distribution methods have become more sophisticated; therefore,
law enforcement personnel and investigators have had to become
more knowledgeable and adept in the field of computer forensics.
Computer forensics is the merger of two distinct and complementary
disciplines, law and computer science. This combination affordes
investigators the opportunities to collect and examine data from computer systems, networks, wireless communications and storage devices
in such a way as to produce admissible evidence in a court of law.1
As defined by Ty E. Howard (2004), Assistant District Attorney,
Chester County District Attorney’s Office, computer forensics is
the study of computers and computer-related media for evidence of
criminal activity. Computer forensics investigations are generally conducted to learn more information and to obtain electronic evidence
from computers since the internet is commonly used for criminal
activity. Computer forensics investigations retrieve data that criminals
mistakenly believe they have deleted from their computer.

According to Dr. Louise Shelley (1998), Professor in the Department
of Justice, Law, and Society at the School of International Service at
American University, and founder and Director of the Transnational
Crime and Corruption Center (TraCCC):
The internet provides a wide variety of opportunities for those who trade and distribute pornography to interact. This activity includes e-mail,
websites, internet relay chat, file transfer protocol
sites, usenet, electronic bulletin boards, online
services and other forms of technology such as
listserv and iphone. Criminal investigations reveal
that these forms of electronic communication
have been exploited by those who traffic child
pornography. The internet has opened up new
opportunities for gathering evidence and data
collection in sex crimes that occur via the World
Wide Web.

When files are deleted, computers do not actually
delete any contents; rather, computers delete the
directory of the files. Until the data is actually overwritten by other data, investigators can still locate
the information to solve crimes. Internet browsing
activities can be also traced by review of cache,
which saves information regarding websites that
users visit with the computers (Sassinsky, 2002).

1

http://www.us-cert.gov/reading_room/forensics.pdf

2

See chapter 110 of Title 18, United States Code.

See 18 U.S.C. §2256(8). Actual or simulated sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or
opposite sex; bestiality; masturbation; sadistic or masochistic abuse; or lascivious exhibition of the genitals or pubic area of any person.
3

4

http://www.bls.gov/oco/ocos157.html

28