Please help - my son has been arrested.

[Mumsie123]

My son, who has mental health problems, has been arrested for viewing child pornography.

He says he has not retained any images, nor has he paid to access any sites but has a compulsion to view things which cause him distress. His situation was in fact referred to the authorities by his therapist who are taking into account the fact that he is actively seeking help for his problem.

He tells me that after he has viewed these images, he runs several programs to remove any evidence of what he has done. These programs are as follows:-

Ccleaner

Free Internet Window Washer

Eraser

The Eraser program is set to wipe unused disc space at the level of US DoD 5220.22-M (8-306. / E, C and E) which consists of 7 passes. In addition, the hard drive is wiped using Eraser each time my son has viewed the images, which he tells me is every few months.

Can anybody tell me whether or not the images are likely to be recovered in view of the above? This would certainly put my mind at rest as whilst I do not condone my son's actions, being convicted of this offence may well result in his already poor state of mind deteriorating further. I am frankly appalled that his confidence has been betrayed by his therapist, but ultimately that is not a matter for discussion here.

Many thanks.

 

[jackjack]

We'll start off with I am not a Lawyer.

Chances of recovery are slim (assuming default settings) unless you(r son) moved the images for long term storage in which case the first two programs will not have deleted the files so a free space wipe of eraser will not get rid of them.

Depending on the country you reside in I seem to remember that using the likes of eraser can be used against you(r son) in that it shows your(r son) was aware of what was being done (downloading CP and covering up the facts) unless you(r son) can prove it was part of some sort of routine (e.g. weekly scheduled free space wipe rather than manual).

You also have to take into account that the Police will if needs be seek out ISP logs or any thing else they deem necessary should they want to prosecute.

The best thing you could do at the moment is Lawyer up. Not that it helps I'd see what can be done about you(r sons) therapist breaching confidentiality, again though depending on your country of residence this may have been acceptable.

 

[Mumsie123]

Thank you for your reply.

When you say 'chances of recovery are slim', what do you mean? My son tells me that the images were not moved or saved and that the eraser settings were default.

Is there any prospect that the images could be recovered given that the wipe free space setting was set to US DoD 5220.22-M?

Thank you.

 

[jackjack]

When you say 'chances of recovery are slim', what do you mean?

By slim I mean a low / small chance.

Is there any prospect that the images could be recovered given that the wipe free space setting was set to US DoD 5220.22-M?

With out having access to your( sons) computer to investigate it is hard to say but I would hazard a guess that if you(r son) used ccleaner with default settings and the images were not moved any where else then a free space wipe using eraser will prevent any recovery of your( sons) browsing habits. That of course, as I said before, depending on your country of residence may not be enough to prevent a conviction.

Seeing as your son has already been arrested I'm sure you'll find out pretty soon once the investigators finish going through your( sons) computer.

If, as I suspect (2+2=5 ), there is no son and you are just trying to get some feed back on whether your methodology is sound, you are falling well short of preventing detection of your activities....

 

[Carver]

You didn't mention which operating system your sons computer is so I will assume it is Windows, Windows is like a giant copy machine. It has files called index.dat, there are 20 to 25 or more they contain lists of every web address your son visited. There are many different purposes for index .dat file, there are folders that contain images too (you don't hav to save the image..mearly veiw the image). Your son could also have had a keyloger, a keyloger is a program that logs keyboard strokes to record what is typed. They are designed to mask them selves against detection. Your sons conputer also has a firewall, it also keeps logs of where he surfed. the list goes on and on I am no expert through. Then there is the ISP issue that jackjack mentioned, the list of things that the ISP can record is quite extencive and they are required by law to keep those records for 2 or three years..it is called data retention. There are other ways you can get caught too(like if a computer repair shop sees anything dodgy. So there is a lot to keep track of. Though it depends on your country of residence and what evidence the police have.

 

[Carver]

.Seeing as your son has already been arrested I'm sure you'll find out pretty soon once the investigators finish going through your( sons) computer.

Very true.

If, as I suspect (2+2=5 ), there is no son and you are just trying to get some feed back on whether your methodology is sound, you are falling well short of preventing detection of your activities....

That is why I didn't reply right away, it is kind of late for prevention. I didn't reveal all I know, just a sample.

 

[jackjack]

Depending on the country you reside in I seem to remember that using the likes of eraser can be used against you(r son) in that it shows your(r son) was aware of what was being done (downloading CP and covering up the facts) unless you(r son) can prove it was part of some sort of routine (e.g. weekly scheduled free space wipe rather than manual).

For completeness sake, the term I was looking for was spoliation