Colorado Sex Crime Attorney Blog

Computer Forensics in Denver: Reading Hard Drive History

Posted by Kyle B. Sawyer | Apr 16, 2014 | 0 Comments

Using a computer forensics lab, Colorado police can view deleted files on your hard drive to charge you. Learn more in our blog.
Your hard drive contains a history of every action taken on your computer. Each file downloaded, accessed, or created, is stored in your computer's memory. It is important to understand that there is no differentiation made by the computer between you and other users – if a file was downloaded or created by someone else on your computer; it's going to look like you were the author or creator. In cases like Sexual Exploitation of a Child – C.R.S. 18-6-403, in Denver, Adams, and Jefferson County, the possession of certain files is crucial. Let's look at how computer forensics works, and how you can defend yourself if you've been charged with a sex offense:

Where Files Go on Your Hard Drive

When a file is written to your hard drive, it takes up space (allocated space),  and is indexed by your operating system. When you delete a file, it doesn't just go away. Instead, it is moved to “unallocated” space and is “de-indexed” by the operating system. You won't be able to find a date on the file, but it will be stored on your hard drive until it is overwritten. Usually, files are overwritten as you use your computer and create new downloads. But, you aren't in control of what is overwritten, or when. Now, we'll discuss why this is important and how dangerous deleted files can be:

Sexual Exploitation of a Child: Images Stored on Computers

Sexual Exploitation of a Child is a sex offense which is charged whenever someone is found to be in possession of (or creating) child pornography. When sexually exploitative material (images or video of children under the age of 18 years of age engaged in sexual activity or “erotic nudity”) is found on a computer, the person who owns the computer will face serious charges. Sexual Exploitation of a Child is a sex offense which carries a sentence of up to 16 years in prison, and registration and treatment as a sex offender.

How Do Police Find Sexually Exploitative Material?

The police and sheriffs in Arapahoe, Douglas, and Larimer County get leads that someone has download child pornography. They contact the Internet Service Provider (ISP) and obtain an address and a search warrant. They will confiscate computers and give them to forensics labs such as the Rocky Mountain Regional Computer Forensics Laboratory (RMRCFL), who are allowed to search hard drives for child pornography. RMRCFL uses software tools such as EnCase and Forensic Took Kit (FTK) to view hidden files (files treated as deleted by the operating system) on a hard drive platter. Once any sexually exploitative photos or videos are found, charges are filed.

What To Do If You Have Been Charged with a Sex Offense after a Computer Forensics Search

The criminal defense attorneys at our office know the importance of working with a private computer forensic examiner in Sexual Exploitation of a Child cases. The best thing you can do if you have been contacted by the police is to remain silent – it is much easier for us to defend someone who hasn't given the police any information.

Request a Free Consultation

If you or a loved one has been accused of possessing sexually exploitative material of someone under the age of 18, be smart, exercise your right to remain silent, and contact an experienced criminal defense attorney at the O'Malley Law Office for a free consultation at 303-830-0880, or submit the “Get Help Now” form. Together, we can protect your future.

Image courtesy of Stuart Miles /

About the Author

Kyle B. Sawyer

I have a passion for defending others in criminal cases. I am able to empathize with my clients and understand their emotions and fears. I have a unique perspective on the criminal justice system and I understand what it feels like to be wrongly accused of a crime.


There are no comments for this post. Be the first and Add your Comment below.

Leave a Comment