Harris takes the stand

Hard drive issues, medical emergencies prolong trial into fifth week

A potential hard drive snafu, plus the defendant Michael Harris taking the stand highlighted the case of People v. Harris, currently in its fourth week of testimony.
After a one-week recess for the Thanksgiving holiday, court resumed on Monday, Nov. 30, and the defense called Rick Albee to the stand. Albee is the owner of Data Chasers Computer Forensics and was brought in as the defense’s computer expert to follow up on the prosecution’s computer expert Lydell Wall, who had testified before the break.
Albee’s biggest moment of the day came after lunch. The witness claimed he had been studying the two hard drives in evidence during the lunch hour. The two drives had allegedly been taken from Harris’ home at the time of his arrest. Previously, Albee had never been able to examine the physical drives. It is standard procedure that he only receives an image of the drive to study, but not the physical evidence.
Upon returning to the stand for the afternoon session, Albee stated that while it was very hard for him to express this feeling, he believed that one of the hard drives before him, referred to as Item 1, could not have been the original hard drive from Harris’ computer. Item 1 was the hard drive containing what the attorneys had been referring to as the “bad stuff,” or child porn, on it.
“This hard drive [Item 1] was manufactured in May 1999, but the computer was manufactured in January 1999,” Albee stated. “Somebody tampered with that hard drive.” According to Albee there was no way a hard drive that was made several months after the computer had been manufactured could have been the computer’s original hard drive.
Prior to his “Perry Mason” moment, Albee had spent the morning hours reviewing the chain of custody record for the hard drives. According to the computer forensics expert, in a typical evidence chain of custody, every person who touches that piece of evidence is supposed to sign for it.
Then, when one person passes it on to the next, they are expected to write down who they are giving it to. The chain of custody for the hard drives showed that this process had not been followed effectively, according to Albee’s manner of doing things. In many of the “from” and “to” boxes, there were numbers rather than names. Some names of individuals who allegedly had dealt with the hard drives were not on the list at all. The serial numbers of the hard drives, which distinguish each drive uniquely, had also been left off the chain of custody list. This, according to Albee, meant that no one could know what evidence they were actually looking at.
Albee also adamantly believed that the child porn images that had been found on the questionable hard drive, or Item 1, had never been viewed by the computer user. He claimed these images were discovered in unallocated space on the computer. Something in unallocated space was at one time on the computer’s hard drive, but doesn’t mean it was accessed by the user.
“Stuff you’ve never actually seen can wind up in unallocated space,” Albee explained. They were created and filed at the same time, which in computer jargon means that they could have been a pop up window in a chain of pop up windows that was created and closed before the user even saw them.
The suspicious hard drive (Item 1) was further discussed when Harris took the stand on Tuesday. He explained that the hard drive known as Item 1 in the evidence bag had a blue label on it. “The hard drive that was sitting in my home had a black label on it,” he said. He claimed he could recall the color of the label because the drive was broken and had been sitting idly in his home for over a year.
Harris claimed that the drive was in such disrepair its information was inaccessible. A computer analyst himself for at least 15 years, Harris claimed he would have known how to access the malfunctioning hard drive if there had been a way to do it. Since there was not, Albee and Harris insinuated that the hard drive known as Item 1 may have been tampered with when sent to what is known as a “clean room” after it was taken into evidence. In a clean room the inaccessible drive is imaged onto a new hard drive so that the information can be accessed. This data transfer was not mentioned during Wall’s testimony, according to defense attorney Therese Hankel. She explained in a brief outside interview that Wall had stated the original hard drive could still be accessed even if it was broken.
While claiming that he had no idea where the child porn images came from, Harris did admit, while testifying on Tuesday, to putting a keystroke logger on the computer. He claimed he had installed this program, which logs every key stroke that a user makes, in order to bust the twin girls who were using the computer when they were not allowed to. The keystroke logger had recorded a user performing searches for “preteen models,” “preteen nymphets,” “preteen breasts” and other suggestive items.
Harris claimed these searches as his own. He also claimed a long list of news groups related to child erotica as his own, but claimed he had not accessed the groups’ sites. He stated he was searching for these items as part of research for his computer software analyzing work. He said he was tracking a specific exploit where when you searched for preteen models, however innocently, porn popped up. Harris claimed there was a huge battle that was in the news around March 2006 that had to do with keywords such as “preteen models.” While some people who wanted their kid to be the next Cindy Crawford were searching for this phrase, perverts were taking advantage of the term and creating links to child porn sites with it instead, according to Harris. Vigilantes trying to catch the perverts were also using the search phrase. Harris wanted to understand “the DNA” of how programs like this worked. He also believed that the Item 1 hard drive had been broken in the first place because of nefarious information that had been installed onto his computer from these sites. He claimed he stopped researching the topics after the hard drive failed.
A search for related news items did pull up a few stories and blogs about this topic from 2006. Web pages www.webmasterworld.com/forum86/4470.htm and www.pcpro.co.uk/news/85201/google-claims-victory-over-doj were the top draws.
A medical emergency on Wednesday recessed the court for the entire day. Thursday, Harris retook the stand and finished his testimony, adamantly stating he had never touched any of the girls who had accused him. Wall then took the stand to begin to tell his side of the hard drive story. After another medical emergency 20 minutes later, the Judge recessed court for the remainder of Thursday. The trial was tentatively scheduled to resume on Friday morning at 10 a.m., but had the potential to be bumped to Tuesday morning, as the Judge had other commitments on Monday.