October 26, 2012

Child porn assertion has suspect crying foul

Mark Strong's attorney says prosecutors ought to be sanctioned if they can't back up comments made in a prostitution case.

By Ann S. Kim akim@mainetoday.com
Staff Writer

(Continued from page 1)

click image to enlarge

Mark Strong Sr. listens to the judge during his arraignment Tuesday at the Cumberland County Courthouse in Portland.

2012 file photo/Tim Greenway

click image to enlarge

Daniel Lilley, attorney for Mark Strong Sr., holds a hard drive that he received as part of the discovery process in Tuesday’s proceedings. He estimated that he has only a quarter of the data in the alleged prostitution case that prosecutors have.

2012 file photos/Tim Greenway

Related headlines

It’s not clear what McGettigan meant by “markers,” and Lilley said he doesn’t know what that means.

He said the hard drive was from a computer in Strong’s home that others could access. It was among the items that were seized from Strong’s home and business in July, when he was charged with the initial count of promotion of prostitution. No one else was charged in the case until last week.

Computer forensics experts who aren’t involved in the case said “markers” could refer to a number of indicators, including file names associated with child pornography, a file’s digital “fingerprints” and other traces of activity associated with a file.

If a computer user downloaded a picture named “illegal.jpg,” for example, and saved it into a folder before double-clicking it, two entries would be created, said David McGroty, who works in the forensics division of Flashback Data, based in Austin, Texas. He said there would be a shortcut in the folder and an entry in the program that was used to view it.

Examiners may find indicators but not necessarily the file, McGroty said.

Another computer forensics expert, Wes Goodwin, said it would not surprise him if investigators did not come across indicators of child pornography right away. He said four months is not very long in the context of a criminal case.

Investigators could have run various analyses that didn’t detect anything at first, or the emphasis could have been on looking for different types of files, said Goodwin, who owns Databank Data Services, also based in Austin, Texas.

Also, much of the examination could have involved time-consuming manual searches, he said.

“If the person was destroying evidence or trying to hide it, there’s different types of analyses to detect that. If you detect things, you’ve got to follow up on that,” he said. “You have to reverse engineer what was there versus what was there in the beginning.”

Staff Writer Ann S. Kim can be contacted at 791-6383 or at:

akim@pressherald.com

Twitter: AnnKimPPH

Were you interviewed for this story? If so, please fill out our accuracy form

Send question/comment to the editors




Further Discussion

Here at PressHerald.com we value our readers and are committed to growing our community by encouraging you to add to the discussion. To ensure conscientious dialogue we have implemented a strict no-bullying policy. To participate, you must follow our Terms of Use.

Questions about the article? Add them below and we’ll try to answer them or do a follow-up post as soon as we can. Technical problems? Email them to us with an exact description of the problem. Make sure to include:
  • Type of computer or mobile device your are using
  • Exact operating system and browser you are viewing the site on (TIP: You can easily determine your operating system here.)