Computer forensic evidence collection and analysis

¶ … 2005, one file sent by the BTK killer to a Wichita television station led police to investigate Dennis Rader, a church president, and ended the 30-year murder spree of this serial killer. What evidence was pivotal in this case?

Computer evidence has become increasingly pivotal in demonstrating the guilt or innocence of a suspect. This has recently been seen in the so-called BTK case. The case is testimony to the value of using computer evidence in modern forensic science. The BTK (Bind, Torture, Kill) killer was linked to eight murders in the 1970s and '80s and then resurfaced in 1991 and later in the 21st century. But when the killer Dennis Rader "came to his pastor in January with a floppy disk, saying he had the agenda of a church council meeting and needed to run off copies on a printer," the electronic imprint in the disk linked Rader to a message sent by the BTK to a Wichita TV station (Computer Trail Led To BTK Suspect, 2009, CBS). The BTK killer was known for the cruel and taunting message he sent to various media sources and this propensity of his was used to 'crack the case.'

Later, other evidence would link Radar to the crime, such as souvenirs he kept of his victims as well as other DNA evidence. But the critical link in the chain was the disk, which gave law enforcement (who had been following Radar) the ability to arrest him with probable cause. Police had been communicating with Radar under the guise of media personalities. Radar left a disk with a message regarding his crimes. "Additional investigation showed the disk was opened in computers at the Christ Lutheran Church and Park City Community Public Library. The file document had been created on February 10, modified on the February 14, and printed that same day. It has been revised four times and was last saved by user 'Dennis.' Most of the information from the disk was found in its properties domain. Such information is automatically written by the software and is based on software registration information and the identity of the user logged on at the time of the activity on the document" (Williams & Landwehr 2006). Investigators were able to easily trace the disk to the church and spoke to the pastor. The pastor helped identify Dennis after investigators confiscated the church computer as evidence.

A dossier on Iraq's security and intelligence organizations was released to the public by Prime Minster Tony Blair as a Word document on the 10 Downing Street Website

(www.number-10.gov.uk) in February 2003. An analysis of the document by Dr. Glen

Rangwala, a Newnham College, Cambridge University lecturer in modern politics,

found that much of the material in the dossier was plagiarized from a postgraduate research student, Ibrahim al-Marashi. Mr. Marashi was based at the Monterey Institute

of International Studies in California at the time. What information was used to prove that the UK government was not the original writer of this document?

The most obvious parallel between the postgraduate research student's work and that of the UK government's dossier was that of language. For example, in many passages the wording was virtually identical. The Government dossier read: "Headed by Saddam Hussein but usually chaired by his son Qusay Hussein, it [the Council] oversees the work of all other security agencies" and Ibrahim al-Marashi's work read "headed by Saddam, but usually chaired by Qusay, the Council includes representatives from the Office of the Presidential Palace and Iraq's five major security units" (Plagiarism, 2003, BBC). But the similarities of language went beyond the superficial. Every writer has his own style -- and also his own propensities towards errors. "Even Marashi's typographical errors and anomalous uses of grammar are incorporated into the Downing Street document. For example, on p.13, the British dossier incorporates a misplaced comma" (Lewis 2003).