بازیابی شواهد دیجیتال پاک شده از دیسک های CD-RW در یک بررسی سوء استفاده از کودکان

The paper describes an innovative method used to recover digital images and videos from an evidentiary CD-RW disc that had been erased. The digital evidence had been erased by the subject of the investigation in an attempt destroy incriminating evidence of the crime. Without the recovery of the digital evidence, there would have been no conviction in the child exploitation case as there was no physical or testimonial evidence.

For many tech-savvy criminals, the Internet has become a highway of criminal opportunity. Crimes such as identity theft, Nigerian letter scams and its variants, spam, botnet extortion attacks, counterfeit checks or postal orders, pharming, pump and dump stock schemes, advance fee frauds, and numerous fake e-mails are used to support financial crimes that net criminals millions of dollars. All these Internet crimes tend to be committed by criminals with well-developed technological skills. Another common characteristic among virtual criminals are their attempts to hide any digital evidence of their activities. This paper examines such an attempt by one criminal to destroy the digital evidence depicting his crimes. This criminal investigation and subsequent sentencing was based on the recovery of digital evidence. This paper describes the innovative recovery method used to find digital evidence of criminal activity on a CD-RW disc. Prior to describing the method used to recover digital evidence, CD-RW discs are briefly explained followed by an overview of U.S. laws affecting this criminal case.

In the investigation, digital evidence included notes from Kaminski. These notes outlined his plan to sexually abuse these children. Kaminski's writings detailed his experimentation with drugs dosages, including Rohypnol, to use to incapacitate his victims. The recovered digital evidence revealed Kaminski describing in detail his initial contact with the victims and their mother as well as his plan to manipulate the mother into trusting him and relying on him. Kaminski described making recordings of the abuse so he could relive the incidents when the children were not present. The investigation resulted in the charging of multiple counts of Sexual Assault 1st Degree involving the drugging and subsequent sexual molestation, abuse, and exploitation of three children who were under 10 years old.12 The defendant entered a nolo plea (plea bargain) which subjected the defendant to the same penalties, fines, and forfeitures as if he were convicted in a trial. Kaminski was sentenced to 50 years in prison, suspended after 25 years in jail, on April 11, 2006, in the New Britain Superior Court. 13 The recovered digital evidence on the discs could not be refuted.