Computer forensics is an important part of many federal criminal trials. When the case involves allegations of internet crimes, pornography charges, or other illegal online activity, the most important evidence may be the information on the computer hard drive.

In many ways the search and retrieval of evidence from a computer is like the search of a physical location. Imagine that the police found narcotics in a house. At first glance this may seem sufficient to secure a conviction against a resident of that house. But what it there are six or eight people that live in the house and the narcotics were found in the living room? There would need to be something more to connect a specific individual to the narcotics. The same is true with information found on a computer.

To understand how the courts look at this, it is helpful to illustrate the difference between constructive possession and actual possession. For example, actual possession would apply to the ballpoint pen when it is actually in your hand; constructive possession would apply to a ballpoint pen that is in a desk drawer in your house. But this assumes that you are the only person that has access to that desk drawer. Constructive possession cannot be inferred when the suspect does not have exclusive control of the place where the contraband was found.

In our next post, we will continue our discussion of constructive possession and it application in computer crimes. Specifically, we will look at a recent Federal Court of Appeals case in which a criminal conviction for possession of child pornography was overturned after the court determined the prosecution had not demonstrated constructive possession.

Source: United States Court of Appeals, Fifth Circuit, “United States v. Moreland” Dec. 14, 2012