Computer Forensic Expert Opinion On “Who” The Computer User Is

In computer-based crime trial, computer forensic examination expert could give an opinion about who the computer user was; the expert's specialized knowledge could assist the jury in understanding the computer and internet evidence in the case; expert was allowed to opine about “who may have put the images on the CDs” and hard drives, in United States v. Huether, 673 F.3d 789 (8th Cir. March 9, 2012) (No. 11-1964)

In the field of computer forensics, it often is difficult for the examiner to conclude "who" a particular computer user was. A computer forensics examination may identify significant evidence including metadata about “what” was found on a computer or other digital media and "when" it was placed there. However, it is a separate question about “who” accessed or placed the content on the computer. For example, in a household with multiple potential users of a computer, how certain can the examiner be about who accessed a particular file?

Sometimes the user may be inferred by the content. For example, if the computer forensic examination confirms that an individual sent and reviewed an email account linked to the individual moments before and after a key event (such as downloading a file or drafting a particular document), it may be logical to infer that the same user was responsible for the key event. The Eighth Circuit recently considered a challenge to the admission of a computer forensic expert opinion that the defendant was responsible for placing images on compact discs and hard drives, under FRE 702.

In the case, defendant Huether was prosecuted for receipt and possession of materials involving the sexual exploitation of minors. The investigation commenced after the defendant’s girlfriend reported that the defendant sexually abused her daughter. A search warrant was executed at his residence which resulted in the seizure of assorted computer equipment and optical computer discs. A forensic examination confirmed a substantial amount of child pornography (including “about 90 hours of video, and 257 images, 50 of which appeared to be duplicates”). At trial, a computer forensic expert testified about the results of the examination. He also concluded that in his opinion “he believed Huether put the child pornography on the hard drives” and compact discs. After his conviction, the defendant challenged the admission of the expert testimony.


The Eighth Circuit affirmed the use of the computer forensic expert testimony. First, the agent was qualified to provide the expert testimony as his “specialized knowledge based on his ten years of experience working as a member or coordinator for the” Internet Crimes Against Children Task Force. Huether, 673 F.3d at 797.

Appropriate Expert Field

Second, the circuit noted that the specialized knowledge of the examiner was appropriate for expert testimony to assist the jury understanding the computer and internet evidence. As the circuit explained, “Because knowledge of computers and internet use differ widely among lay jurors, Agent Erickson’s testimony appropriately helped better understand the evidence.” In particular, the expert “testimony assisted the jury in processing information relating to whether Huether downloaded and saved the images and videos to his hard drives.” Huether, 673 F.3d at 797 (citing United States v. Davis, 457 F.3d 817, 824 (8th Cir. 2006) (“Expert testimony is appropriate when it relates to issues that are beyond the ken of people of ordinary intelligence.”)).

Computer User Opinion

The Eighth Circuit found the expert opinion was admissible that the examiner “believed Huether put the child pornography on the hard drives” and compact discs. The agent explained the opinion was “[b]ased on the detailed file structure and the way that they were consistent among all the computers that we discovered child porn . . . the only person that was at both residences was Ray Huether.” Huether, 673 F.3d at 797. The circuit noted that the rules contemplated this inference by the expert:

Contrary to Huether’s contention, “[t]he use of opinions is not abolished by . . . rule [702], however. It will continue to be permissible for . . . experts to take the further step of suggesting the inference which should be drawn from applying the specialized knowledge to the facts.” Fed. R. Evid. 702 advisory comm. notes, 1972 Proposed Rules; see also Fed. R. Evid. 703 and 705.
Huether, 673 F.3d at 798.

Harmless Error

Finally, the circuit noted that even assuming that the expert testimony somehow “invades the jury’s province as the trier of fact,” the error was harmless based on other evidence. The defendant had admitted during an interview with an officer “that he moved the images from one folder to another in the hard drives and later put them on compact discs.” Huether, 673 F.3d at 798.

The Huether opinion highlights an important area involving computer forensic examination experts. While an expert may not always be able to identify who was that was responsible for particular evidence found on a hard drive or other computer media, on the facts of the case the inference was permissible to identify the defendant.


Subscribe Now To The Federal Evidence Review

** Less Than $25 Per Month ** Limited Time Offer **

subscribe today button

Federal Rules of Evidence