July 01 2013
In a recent murder case, a woman was strangled to death. Digital forensic evidence was presented suggesting the crime was premeditated, which the defendant denied. It was alleged the defendant had twice performed a Google search for “garrotted”, on one occasion a week before the incident and another six months earlier.
When Keith Borer Consultants examined the computer, the earlier web search was found to have been erroneously reported. Due to unusual circumstances on the defendant’s computer, the Police’s in-house tools had misinterpreted this data. Manual analysis and further testing by KBC were able to prove that only the later search had, in fact, taken place.
Whilst a Google search for “garrotted” a week before a woman was strangled to death may still appear damning, it was important to examine the context of the search. We were able to provide evidence to corroborate the defendant’s story, which revolved around a light-hearted Facebook conversation regarding a photograph of a woman with a tightly knotted neck-tie, which the defendant thought resembled her being garrotted, but wasn’t sure how to spell the word. Analysis showed a Google search for “garoted” (sic), followed by a Google-suggested correction to the proper spelling. This was followed by a visit to the “Wikipedia” webpage for garrotting, consistent with the defendant wanting to check the meaning of the word.
This evidence was used to show a very different context to that which the prosecution were alleging. The erroneously reported search shows that even digital evidence which can appear irrefutable can benefit from expert review, and the activity identified by KBC demonstrates why the context of computer activity may be just as important as the act itself.
