Computer Forensics Docket Sheet

The defendant appealed from a conviction under a federal computer-fraud statute, arguing, inter alia, that the prosecution had tampered with the evidence leading to his conviction. An investigation of the defendant's former employer's network revealed that a string of computer commands, designated as a “Time Bomb,” had been programmed to automatically delete massive amounts of the company's data at a predetermined time. Kroll Ontrack, an e-discovery services provider with headquarters in Eden Prairie, MN, investigated hard drives damaged by the Time Bomb program. On appeal, the defendant argued that the government tampered with copies of the hard drives it received back from Kroll Ontrack because the drives were not the same as those provided by the Secret Service. Specifically, the defendant claimed that different amounts of “zeroes” were inserted onto the drives. The defendant also alleged that his expert fully recovered the lost data once the zeroes were removed. The defendant further argued that four files were added onto copies of the drives from Kroll Ontrack, one of which was deleted and no longer contained data, and three that consisted of resumes and correspondence documents. Rejecting the defendant's arguments, the court upheld the defendant's conviction and found that the defendant's failing to show the discrepancy among the copied drives was sufficient evidence to overcome the trial court's determination. Lloyd v. United States, 2005 WL 2009890 (D.N.J. Aug. 16, 2005). See also, United States v. Lloyd, 269 F.3d 228 (3rd Cir. 2001).