What is a Digital Forensic Examination?

Child pornography cases almost always involve electronic evidence. Illegal child pornography can be found on a computer hard drive, cell phone, external drive, thumb drive or any other device capable of storing data. Most child pornography is easy to find on these devices but some users hide the material, encrypt it, or delete it. That's where the forensic examination comes in.

A digital forensic examination refers to a process of accessing the data and organizing it, wherever it may be found on the device. These days, an Israeli company called Cellebrite dominates the market in offering software and hardware that can be attached to a cell phone or hard drive and extract the data from it. Cellebrite can often access even encrypted or deleted data. Once the data is extracted, it can be searched using "hash values" -- individual digital fingerprints -- for known child pornography, which is kept in a database for law enforcement by the National Center for Missing and Exploited Children.

In order to conduct a forensic examination of a digital device, police normally need either a search warrant or consent. It is almost never in an individual's interest to consent to a forensic examination. A warrant must be supported by probable cause, meaning that a reasonable person would have reason to believe that the material, which is evidence of a crime, is present on the device. One of the few ways to defeat a child pornography case is to show that the forensic exam was illegal, done either without consent or without a valid warrant.