14 DAY TRIAL // In the Michael Jackson Death Trial, DEA Computer Forensics Examiner Stephen Marx revealed this week that he had found emails the defendant Dr. Conrad Murray had sent from his iPhone hours before Michael Jackson died on June 25, 2009.
Marx recovered critical timeline emails, as well as digital medical charts that were previously thought to be inexistent. To do so, he used a forensic tool called EnCase.
The key piece of evidence, according to Computer Forensics International, was a damaging audio recording of an impaired Michael Jackson reportedly made by Murray.
"iPhone users would be stunned to learn the amount of recoverable data we can get", says Mark McLaughlin of Los Angeles based Computer Forensics International.
"When you hit delete it doesn't necessarily mean that message, text or picture is gone forever. You're just telling the iPhone, don't show it to me anymore and it flags that deleted data so it can be overwritten. So depending on the activity after the deletion, we may be able to bring it back like it was never deleted," said McLaughlin.
McLaughlin routinely uses sophisticated software tools like EnCase on civil and criminal cases, said the examiner.
According to Computer Forensics International, forensic experts “start by first making a copy of the iPhone's entire memory – which includes active and deleted data. This exact copy doesn't disturb the original data which makes the examination forensically sound and admissible in court. Then the copy can be searched either visually or by using keywords.”
The forensics group says that data that has been recovered is ultimately put into known iPhone categories and it eventually gets displayed.
McLaughlin added: "Our SmartPhone forensic capabilities have improved exponentially. But it stands to reason because they're just pocket computers, and we've been searching them successfully for nearly 20 years now. So I guess people need to realize that if it's there, we're usually going to find it".