How Computers Figure in Crime, and Why It's Not Like TV
Where you are: Part I — Foundations of Computer Forensics · Lesson 1.3 · This lesson follows Chapter 2.1 of Dr. Al-Doori's IT Forensics Essentials: the opening of the crime-scene response section.
What you'll be able to do
By the end of this lesson you will be able to explain the different roles a computer can play in a crime, and why real forensic work looks nothing like television.
- State the book's working definition of computer forensics and its goal.
- Classify a device's role in a crime into one or more of four categories.
- Explain why browsing files or guessing passwords at a scene can destroy evidence.
The Goal: From Crime Scene to Courtroom, Untainted
Chapter 2 opens with a working definition: computer forensics is the process of collecting, preserving, analyzing and reporting the contents of digital evidence from a crime scene. The goal is twofold:
- Get the evidence from the crime scene to the courtroom without tainting it in any way.
- Make sure the exact analysis can be repeated by someone else, who should reach the same result.
If either part fails, the evidence could be ruled inadmissible, which means the court will not consider it at all. This goal shapes everything an examiner does, from the first minute at a scene to the last page of a report.
Four Ways a Computer Can Figure in a Crime
Dr. Al-Doori explains that a computer can be involved in a crime in several ways. Almost every case falls into one or more of four categories.
- The instrument of the crime. The computer is used to commit the crime itself, and the crime would not be possible without it. Hacking into a network or launching a denial-of-service attack are examples.
- A store of evidence. The computer holds evidence of a crime, even if its user does not realize it. The book's examples range from a drug dealer's spreadsheet of who owes money to a person who searches online for ways to commit a crime. It cites the Casey Anthony trial in the United States, where evidence was presented that someone had searched for the term "chloroform".
- A means to commit a crime. Closely related to the first, the computer is the channel used to reach a victim, for example when someone uses the Internet to contact and exploit a person.
- Corroboration. The computer backs up or contradicts other evidence: phone or Internet log files, GPS coordinates, or file timestamps that confirm where someone was or when something happened.
The book stresses that these categories overlap. A person may use a computer to commit a crime and also store evidence of it on the same machine. A smartphone fits several categories at once because it messages, navigates, photographs and logs calls. In the chapter's recap, the same idea appears in three words: a computer can be the target of a crime, the means of the crime, or an accessory to it.
Not Like Television
Crime dramas solve a case in 45 minutes. A detective arrives, opens the suspect's laptop, scrolls through recent documents and announces the answer. Dr. Al-Doori is blunt: that is not how things happen in real life.
- Browsing destroys evidence. If a first responder starts looking through files, the crime scene is already being damaged. Opening files and folders changes access times and other records, and it becomes hard to tell what the suspect did from what the responder did.
- Guessing passwords can lock you out for good. The book warns that an officer who guesses a phone's passcode wrongly too many times may lose access to the phone completely.
- Real work takes time. The book notes that a TV show would be very boring if we had to watch someone copy a 100-gigabyte drive, a process that could take an hour or longer.
- Authority has limits. Investigators do not have free rein to go on a wild goose chase. They are limited by the scope of their warrant or other authority. Lesson 1.4 explains why.
Competence comes from training and practice, not from television.
Real-World Example
Imagine (a fictional scenario) a harassment case. A victim reports months of threatening messages. Police obtain a warrant for the suspect's smartphone, and its examination shows three categories at once, and could easily have shown a fourth:
- The phone was the means: the threatening messages were sent from an app on it.
- It was a store of evidence: it held photos of the victim's home, taken from the street.
- It corroborated other evidence: its location history placed it near the victim's home on the dates in the victim's diary.
- Had the suspect also broken into the victim's social media account from it, it would have been the instrument of that offense too.
A responder who scrolled through the phone at the scene might have changed its data. One who tried a few obvious passcodes might have triggered a lockout. The case depends on doing neither.
From the Book to 2026
What the book teaches. Do not trust TV: a responder who browses files damages evidence, and one who guesses a phone's passcode wrongly too many times may lose access to the phone completely. Copying a 100-gigabyte drive could take an hour or longer.
Why it made sense. Both warnings were true when written and are still the right instincts.
What has changed. The warnings are stronger now. Apple documents escalating delays after wrong passcodes on iPhone, from one minute after the fourth wrong attempt to eight hours after the ninth. If the owner has turned on Erase Data, ten consecutive wrong attempts remove all content and settings. Phones are also encrypted by default, so a locked phone may be inaccessible to everyone without the passcode. And drives have grown: a 100 GB drive is small today, and multi-terabyte drives can take many hours to image. One more update concerns the book's own example. In the Casey Anthony case, the software developer whose tool had produced a figure of 84 visits to a "chloroform" website later said publicly that the site had been visited only once. You will study that error in Lesson 4.1, because it shows why tools must be checked.
What to do now. At a scene, never guess passcodes and never browse. Isolate and protect the device according to procedure, and leave unlocking to trained specialists acting under proper authority. Plan for imaging to take hours, not minutes.
What Would You Do?
You are first at a scene and find a suspect's phone on the table, screen locked, with a notification preview showing part of a message that seems relevant. A colleague says: "Let's just try his birthday as the passcode, it's probably that." What do you do? Decide, then compare with the model answer in the note below.
Knowledge Check
A suspect's laptop holds a spreadsheet listing people who owe him money for drugs. Which category best describes the laptop's role?
Why is a first responder looking through files on a suspect's computer a problem?
A file's timestamps show it was modified at the time a witness says the suspect was at home. Which category does this illustrate?
Answers explained
- Question 1: c. The laptop stores evidence of a crime that was not itself committed by computer. It is not the instrument (a) or the target (b).
- Question 2: b. Browsing changes access times and other traces, damaging the evidence and muddying whose actions are recorded. Speed (a) is not the main issue, and the platform (d) is irrelevant.
- Question 3: a. The timestamps support or contradict other evidence, which is corroboration. Timestamps are often evidence (d), although Lesson 3.6 shows they must be interpreted carefully.
On "What Would You Do?": Refuse to guess. A wrong guess adds delays and, if Erase Data is on, could wipe the phone after enough attempts. Photograph and note the screen as it appears, including the notification, isolate the phone according to procedure (for example, from networks, to prevent remote wiping), and hand it to trained specialists with the proper authority.
Key Takeaways
- The goal of forensics is to get evidence from scene to court untainted, with analysis that someone else can repeat.
- A computer can be the instrument of a crime, a store of evidence, a means to commit it, or corroboration, and often several at once.
- Real forensic work is slow, careful and bound by authority: no browsing, no guessing passcodes.
- Default encryption and lockout protections make "do not guess" more important than ever.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 2.1
- Apple Platform Security — Passcodes and passwords
- NBC News (New York Times) — Was Casey Anthony prosecuted with inaccurate data? (July 2011)
- NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response