Investigating the Scene of Crime in general

In general

The defense attorney should visit the location at which the computer crime is alleged to have taken place as soon as possible after entering the case. In a well publicized case, a number of people will want to see the scene of the crime very quickly. Changes that may be significant to the defense may take place before the defense gets there. Counsel should view the scene with any experts who may be necessary to explain the operation of a computer environment. Pictures, diagrams with dimensions, and observations of the flow of work and people should all be made at this initial visit.

When the "scene of the crime" involves computers, there are many variables that the defense attorney will want to take into account. Most computer systems are dynamic systems, and that which is taking place in the computer center is not readily apparent. The attorney needs to know the types of work being run on the computer, what people have access to terminals or other control mechanism that can override the computer functions, the personnel who are normally working in the computer center at that time, that passwords in effect, and the access by others in and out of the computer area.

When counsel visits the scene, he or she should look for any items that might be crucial in determining whether the accused did commit any of the offenses charged. Signs of entry to the computer room, evidence of computer use contained in logs, environmental monitors like those for heat or humidity, fingerprints on relevant terminals, and internal records of the computer itself may be crucial. Often it will be helpful for counsel to bring technical experts to the scene to analyze it.FN57

Where a computer is used for processing data entered from remote terminals, counsel should view a number of these terminals because they may represent part of the scene of the crime.FN58 In addition to the resources already mentioned, counsel should take advantage of the experience of any investigators who have viewed the scene, as well as any of the victim's computer experts or personnel who can shed light on the significance of the information about the scene that counsel has gathered.