Data Recovery Unearths Clues in Murder Case

A leading computer forensics expert gave evidence this week in the trial of a man accused of a murder which took place more than eight years ago.

Craig Wilson of the Digital Detective Group was called upon to provide insights into the computer history of Danilo Restivo, accused of the murder of Heather Barnett in Bournemouth in 2002. Mr Wilson was asked to give his opinions on the computer history of the defendant, pointing to his whereabouts and activities on the day the crime was committed.

Mr Restivo was attending a course at a Nacro training centre in Bournemouth around the time of the murder, and police took possession of the hard and disk drives of the computer he was using at the centre. Using advanced hard disk recovery and data recovery techniques, Mr Wilson was able to piece together a picture of the defendant's computer activity on the day of the murder and also on the days following.

"I drew on all the computer data to draw up a timeline of all the activity on that computer that day," said Mr Wilson, who found that the computer had likely not been used until after 10am on the day of the crime. This supported the prosecution's theory that Mr Restivo had killed Ms Barnett at 9am on that morning, then headed to the Nacro centre.

Mr Wilson's data recovery techniques also found fragments of news stories about the murder on the hard drive, which had been accessed in the days following the crime.

Although hard drive recovery techniques are more commonly used to retrieve data from damaged drives, their use in forensic cases shows just how much information can be accessed on drives, even once it has been deleted.

Blog archive >>