Cyber sleuth follows electronic trail

March 03, 2001

Cyber sleuth follows electronic trail


Ralph C. Hackney could be called a cyber sleuth.

Armed with such tools as computers, specialized software, duplicators and a digital camera, Hackney, a forensic computer specialist, examines hard drives and other digital storage devices to recover, in part, evidence of electronic crimes.

"I'm a fact finder," said Hackney, who founded CPU Forensics last year. "All I can do is produce what's there already."

Hackney, 47, of Emmittsburg, Md., offers a variety of services to clients ranging from concerned parents to small business owners and attorneys.


CPU Forensics provides consultation services, in-house inspection of personal computers for stored graphical images, and recovery of electronic information that has been deleted, Hackney said.

Using cutting-edge software, Hackney can find out which Web sites have been visited - even if the history has been erased - and recover graphic images that have been deleted or renamed on home computer hard drives, floppy disks and other storage devices, he said.

A parent might hire Hackney to search the computer of an adolescent suspected of visiting adult Web sites. Or a small business owner might hire him to gauge employees' productivity by checking their computers for evidence of time spent on the Internet for purposes other than work.

And he's the computer crime counterpart to a forensic medical examiner.

"I'm doing the same thing, only I'm cutting up computers," said Hackney, who works full-time as a computer specialist for the federal government.

He said his most troubling work involves cases of computer crimes against children.

"I truly believe that if I can help get that one piece of scum off the Internet I've done my little part," he said. "I feel like I'm protecting my family in some way."

Recovering and reviewing electronic evidence of crimes such as using the Internet to solicit sex with a minor and possession or distribution of child pornography can be "really stressful," Hackney said.

"Kiddie porn has got to be the most difficult because the victims are so helpless," he said. "How long can you hold out staring at different pictures of a young child with an adult male? It makes me sick to see that."

"I have to keep blinders on; I just need to find facts."

Despite his own feelings, Hackney said that as a consultant he accepts jobs from both prosecutors and defense attorneys.

Hackney was retained by local defense attorney Bruce Poole to examine e-mail and transcripts of Internet chat room conversations recovered by the Maryland State Police special computer crimes unit in the child sex case against former Hagerstown City Councilman Steven Spalding.

Spalding was sentenced in December to five years in prison for sexually exploiting a girl he met on the Internet when she was 11.

Spalding met the girl in an Internet chat room in 1997 and communicated with her online for several years before meeting the girl at her home. Their visits progressed from hugging to sexual intercourse, according to court records.

A cyberspace task force of federal and state police investigators in one year conducted 41 criminal investigations of Internet crimes against children, Maryland State Police Superintendent Col. David B. Mitchell announced Feb. 9. The investigations led to 23 arrests.

"Criminals continue efforts to expand their activities through computer technologies, especially in the exploitation and abuse of our children," Mitchell said.

Although the number of computer crimes against children and other high-tech offenses continues to increase, most people don't think it could happen to them, Hackney said.

"It's going on every day but everybody's blinded by it," he said. "People are not aware."

Cyber crimes also evolve in tandem with ever-changing computer technology, Hackney said.

His active memberships with the International Association of Computer Investigative Specialists and the High Technology Crime Investigation Association provide continual industry updates and access to a worldwide network of computer forensics experts, he said.

Computers are used for criminal activities ranging from hacking into other systems to illegal bookkeeping to altering spreadsheets for money laundering purposes.

Electronic crime secretly violates the integrity of a normal process, makes it more difficult to identify the perpetrator and often leaves a trail detectable only by an expert, Hackney said.

Law enforcement officers must have probable cause to obtain search and seizure warrants for computer systems.

Hackney, who completed forensic examiner training with the IACIS, HTCIA, the Federal Law Enforcement Training Center and the National White Collar Crime Center, could be hired as a forensics expert to oversee or conduct the seizure and/or to do a forensics examination on the seized computer equipment, he said.

He tackles the job with a suitcase full of computer forensics tools.

Hackney first cleans his own computer's hard drive to clear it of any images or documents before downloading evidence from the seized digital storage devices, he said.

He then takes digital photographs of the search area and makes a duplicate copy, or back-up, of the evidence drive before leaving the search scene for his own work area, Hackney said.

He always scans for viruses before beginning his examination of the evidential storage device with specialized software, evidence searching tools and programs for recovery that are only available to trained law enforcement professionals, Hackney said.

He can be reached via e-mail at

The Herald-Mail Articles