E-mail evidence can be found everywhere

WASHINGTON -- Not since the glory days of letter-writing, before the telephone, have people committed so much revealing stuff to written form as they do in the computer age.

All those e-mail messages and electronic files are a treasure of evidence for law enforcement officers, whether they are targeting terrorists, crooked CEOs or local drug dealers.

The challenge for police and prosecutors is learning how to dig up these electronic gems.

"Any agent can come in and look through papers, but not every agent can do a thorough computer search," said David Green, deputy chief of the Justice Department's computer crime section, which helps train investigators.

Green teaches that a mistake as simple as turning off a computer can wipe away evidence. Knowing such basics, and the ins and outs of privacy law, is essential when electronic evidence may play a role.

"It's like the gift that keeps on giving," said Tom Greene, a deputy attorney general in California, a state suing Microsoft Corp. in an antitrust case built mostly on computer messages.

E-mail exposed Merrill Lynch analysts condemning stocks while touting them to investors.

Anti-American sentiments in messages Taliban fighter John Walker Lindh and shoe bomb suspect Richard Reid sent to their mothers were gathered as evidence against them.

When Wall Street Journal reporter Daniel Pearl was kidnapped and killed in Pakistan, investigators used e-mails to track his abductors.

When a company is sued, it can be forced to turn over thousands of employee messages.

"E-mail has become the place where everybody loves to look," said Irwin Schwartz, president of the National Association of Criminal Defense Lawyers.

One reason is that computer data is difficult to destroy. Just clicking "delete" won't do it.

Deleted files can linger, hidden on a computer's hard drive until that space is overwritten with new information.

Investigators may also be able to track down e-mail in an employee's office server, stored by Internet providers, or in the recipient's computer.

To go hunting through computer data, officers need a search warrant from a judge.

Criminals, or people who want to protect their secrets, can use encryption to scramble their e-mail. And software can overwrite computer files, so they are truly deleted. Most criminals aren't that savvy yet, prosecutors say.

Investigators usually prefer to use special software to make an exact copy of the contents of a computer's hard drive. This can be done without turning on the computer.