Forensics in IT

We are living  in the digital Age.  Everything is highly recorded in binary – e.g. Videos, emails, applications - and can be used as proof for helping solve trials. 

I have worked as forensic expert in Information Technology in trials in courts in Buenos Aires, Argentina from 2012 till 2016.  During that time I was assigned to work in about 110 trials, it seemed that not many engineers were interested in working as forensic experts.

Being a forensic expert involves doing quite a lot of procuration  at courts and work on solving the matters the defendant and/or the prosecutor part asked for.
In my case I had the guidance of my husband, who had 20 years of experience in forensics  as he is ‘questioned document examiner’, he has the ability to say if someone’s writing (also signature) was done in some document.  So procuratory matters and procedures were not an issue for me, that is something not difficult but different from the common work of an IT professional.

 
Some of the jobs I had to do were:

- Go to a company's building with a 'Justice Officer'  and ask to get into their offices and check systems, servers or computers looking for requested information or illegal software installed. 

- Verify emails sent and received so these could be used as proof.  Some of the emails contained information about contracts or employee’s job exchanging information between parts about the trial matter.  I had to check the metadata of the questioned emails in search of the sender and receiver email addressed, servers involved, dates, message and attachments data.

- Determine if some important web search engines had the responsibility about the not desired search results for famous people, artists, models, etc. – for example, they appear in porn sites.

- Quality enhancement of a video taken during a football match where the prosecutor accused the police officers for beating him when he was not taking part of the disturbances.

- Disclose information in systems, applications, databases, looking for required recorded data.  For example, trials against Airlines where the contract regarding the tariff of the ticket bought details were shown on the airline website online.

- Verify that the construction plans (drawings) of an architect that were stolen by a constructor, where created before the starting date of the building.

- Check information in systems about a repair work of a gas leak and complaints recorded forehand, when the prosecutor was injured in an gas explosion.

 

After all the ‘field’ work I had to write a report about the arrived results, and go through some procedures where the parts had the right to question the report I have done. 

After the expert field work finishes, it can pass years after the judge gives the final veredict, where both parts also can ask for a supreme court to change it on their favour, and then the judge can regulate fees for the lawyers and experts involved in the process.  The fees can also be questioned and the parts can ask the supreme court to change them too, and sometimes more years could pass until the whole process finishes.

The pay sometimes was bad, as the amount of fees could not be fair, because it depended on what the Judge decided you deserved and the final veredict arrived.  The pay could came after many years you did the job, or never was received (yes! I worked many times for free), if the part does not have enough money or is in wreck, you are the last person in the line to receive something or anything at all.


Anyway I do not regret being able to participate in Argentina’s Justice Trials and work with IT in a different way.

I do not know how Forensics work in Japan in Trials, it would be interesting to find it out.  Someone knows?  Someone have worked in other country in trials?  

 

Just remember, next time you write an email just be sure to be writing to the right person, the right message as it could be used against you.  Or maybe in other case, be sure to write an email with the content that can be used for your benefit, you could win a trial with it!