LSVA.com

by **David-Napper** » Thu Mar 17, 2005 12:51 pm

Court Finds Computer Mirror Image Properly Admitted

State v. Morris, 2005 WL 356801 (Ohio Ct. App. Feb. 16, 2005). The
defendant appealed convictions relating to pandering sexually-oriented
matter involving minors. The defendant’s son testified he called the
police after finding pornographic images of minors in the recycle bin of
his computer, which the defendant had previously used. During a forensic
analysis of the computer, a computer forensic expert mirror imaged the
hard drive. Before returning the computer, the expert overwrote the
hard drive, erasing all data on the drive. At trial, the state presented
the mirror image copy as evidence. The expert testified it was
standard protocol not to run tests on the original hard drive in order to
prevent corrupting the evidence and stated the mirror image was an exact
copy of the original hard drive. The expert further noted he wiped the
hard drive because it was corrupt and repeatedly accessing and testing
the drive would have rendered it useless. On appeal, the defendant
argued he was denied an opportunity to examine the original hard drive to
see if it contained exculpatory evidence. The court declared state
evidentiary rules permit admission of duplicates and noted the expert had
testified that the copy was an exact copy of the original hard drive.
The court upheld the convictions, finding the defendant failed to
specifically argue what type of exculpatory evidence may have been lost
during the copying procedure and the original was not destroyed in bad
faith.

This sounds like an amazing case...Id love to see the transcripts on this one. For two reasons…

1.) Erasing the original hard drive serves no purpose for either side and goes squarely against all known and documented evidence collections standards.

2.) The term "Mirror" is a misnomer....there is no such thing as a "Mirror" image of a hard drive in forensic processes. A "Mirror" shows the exact opposite of whatever is placed in front of it. And this, of course, is not what is done when a forensic image is secured of a particular hard drive. So, id love to hear what this “expert” defines as a “Mirror” image…

by **malterb** » Mon Jun 20, 2005 1:27 pm

The obvious issue here is the so called forensic expert, was apparently not. A qualified forensic expert would use software that would not erase the original hard drive. On the surface this is a mistake not made by someone who is a qualified forensic expert (and the reasons were not defined here)

The defendants attorneys seemed to not be prepared to argue properly against the data collected. A good expert on the other side could have argued this point

There are holes within the details here, and a full transcript would probably clarify.

The point to be made by this case should be, be sure your forensic expert is qualified. Also if forensics are involved whichever side you are on find a qualified expert.

We have been involved in situations where opposing counsel hired unqualifed forensics experts and it only added to problems within the case.

Technically your definition of a mrror image is correct, however, it is a commonly used term that is widely accepted.

Bruce Malter

by **JCadden-Mobile** » Mon Jun 20, 2005 1:41 pm

Bruce,

I agree fully with your reply with one exception.

The term mirror image has never been used or propagated by any forensic organization that I am aware of. (Not that I am god's gift)

I have however heard it used many times in the lit support industry and legal realm.

I for one would not want to be sitting on the witness stand when questioned by console as to why I used a term that is not only technically incorrect, but fundamentally incorrect as well. Small things like this can make a jury's mind wander far and wide about the credibility of a supposed forensic examiner. A person who uses this term, as well as many other catch phrases out there, would find little solace from accredited forensic organizations whose documentation of best practices and terminology, training materials...etc, would not support such a definition.

by **malterb** » Mon Jun 20, 2005 3:12 pm

A few uses of Mirror Image.

http://www.rfdlaw.com/ComputerForensics.html

http://www.nysacdl.org/aa/DOCUMENT2004- ... MAGES.html

http://msdn.microsoft.com/library/defau ... Format.asp

Now if you want to talk semantics, and start a real industry argument, let's talk about the gross misuse of the terms forensics and Electronic Data Discovery.

by **malterb** » Mon Jun 20, 2005 3:14 pm

One more:

http://www.forensics-intl.com/def2.html

by **jcadden** » Mon Jun 20, 2005 5:22 pm

None of those organizations are legitimate forensics authorities,(not even Microsoft…the king of all catch phrases) with the exception of NTI, who has a long standing record in the industry. And even then, they put it in a way that references it's catch phrase status. Which is the only way they could put it, as they are also a resource for educating forensic examiners. So for these reasons, I would still never use that term in my reports or speak it aloud in a court of law. In fact, Id never say to anyone, as it opens the door to criticism and well motivated questioning about my knowledge and credentials as a practitioner. Bad mojo if you ask me...

As for the misuse of forensics and EDD....I agree, I don’t want to go there either.

by **malterb** » Tue Jun 21, 2005 10:26 am

Nor would I ever use Mirror image in a report. In an idle conversation yes, because it is a term that is easliy understood. In a written report, a formal status meeting, on the stand, in an email, etc. no never.