The opinion of the court was delivered by: Muir, District Judge
On August 12, 2004, a two-count Indictment was returned by a Grand Jury sitting in the Middle District of Pennsylvania charging William Heiser with sexual exploitation of children in violation of 18 U.S.C. § 2251(b) (Count 1) and knowingly receiving and distributing child pornography in violation of 18 U.S.C. § 2252A and § 2256(8)(B). The Government specifically alleges that Heiser "being the parent, legal guardian, and person having custody and control of a minor did unlawfully and knowingly permit such person to engage in sexually explicit conduct . . . for the purposes of producing visual depictions -- digital images, computer images, and computer generated images -- of such conduct . . ." and "unlawfully and knowingly receive[d] and distribute[d] material that . . . contain[ed] child pornography . . . ." The case is presently on our May, 2006, trial list for a non-jury trial.
On February 2, 2006, Heiser filed a motion entitled "Motion to Dismiss the Indictment or in the Alternative to Suppress the Computer Evidence Due to Destruction of the Hard Drive." The matter was fully briefed and an evidentiary hearing was held on April 20, 2006. The following are the court's findings of fact, discussion and conclusions of law.
1. On May 18, 2004, Berwick Police Officers seized one Discount Computer, 19 floppy disks and two zip 100 MB disks from Heiser's residence at 602 Green Street, Berwick, Pennsylvania. (Undisputed, hereinafter referred to as "U")
2. On September 16, 2004, the Government provided Heiser with a packet of discovery. (U)
3. Included in the discovery provided by the Government on September 16, 2004, was a one-page "General Investigation Report" dated June 28, 2004, prepared by Computer Crime Analyst Dale R. Young of the Bureau of Criminal Investigations Area II Computer Crime Task Force, Pennsylvania State Police. (U)
4. After receiving Defendant's computer on June 14, 2004, Mr. Young attempted to acquire an image (bit-by-bit identical copy) of Defendant's hard drive using standard and widely recognized forensic procedures but could only do so after several attempts because the computer and hard drive were in poor condition. (U)
5. Young observed that the cooling fan was inoperable, causing the hard drive to overheat, and that the computer itself was covered in (sic) pet hair. (U)
6. Mr. Young states the following in his General Investigation Report dated June 28, 2004:
6.1 that he "conducted a forensic examination" of the computer seized from Heiser's residence; (U)
6.2 that "the hard drive image was acquired using EnCase software, and the F.R.E.D. (Forensic Recovery of Evidence Device) system which write protects the hard drive being acquired which does not allow any changes to be made to the hard drive"; (U)
6.3 that "[t]he image files were subsequently saved to the evidence drive of the F.R.E.D. and were viewed with EnCase"; (U)
6.4 that while searching HTML files found in unallocated space, "one file indicated 'Belarc Advisor,' a program for catalogueing (sic) an operating system and all the programs on a computer was run on Friday, April 30th, 2004, by Bill HEISER."; (U)
6.4.1 that with respect to the file regarding the Belarc Advisor, "[t]his document, which is attached to this report, shows all the software programs, users and registry settings installed on the computer being tested"; (U)
6.4.2 that Belarc Advisor "report showed that there were three users: Bill, Melissa, and Willie Heiser"; (U)
6.4.3 that according to the Belarc Advisor report "Jamie Heiser was not listed as a user on the computer"; (U)
6.5 that when he previewed the floppy disks and zip disks he found a disk labeled "2 of 6" which contained "eight files, apparently a diary written by" Jamie Heiser; (U)
6.6 that he "found 21 images of suspected child pornography in allocated space under the directory C:\program files\agent, and 495 images of suspected child pornography in unallocated space, some of which appear to be the suspect's daughter Jaime HEISER"; (U)
6.7 that "[a]ll suspected child pornography images were copied to a CD and supplied to SGT. McCORMICK"; (U)
6.8 that "[n]o changes were made to the original hard drive at any time during the course of the examination"; (U)
6.9 that "[a]ll evidence was returned to Sgt. MCCORMICK on 8/11/04"; and
6.10 that an EnCase report is attached. (U)
6.10.1 The EnCase report was not attached to Mr. Young's General Investigation Report dated June 28, 2004, which was provided to defense counsel in discovery on September 16, 2004. (U)
6.10.2 By letter of December 13, 2005, the Government provided to defense counsel a 13-page EnCase Report. (U)
6.11 The Belarc Advisor document was not attached to Mr. Young's General Investigation Report dated June 28, 2004, received in discovery on September 16, 2004.
6.12 A Belarc Advisor document was provided to defense counsel by the Government on December 21, 2004. (U)
6.13 Heiser ultimately received in discovery what purports to be a copy of the 495 images of suspected child pornography in unallocated space copied to a CD on June 28, 2004, and supplied to Sgt. McCormick; (U)
6.14 Heiser has never received copies of the 21 images of suspected child pornography found in allocated space purportedly copied on June 28, 2004, to a CD and supplied to Sgt. McCormick.
6.15. Counsel for Heiser was permitted to view the 21 images of suspected child pornography found in allocated space.
6.16. The 21 images of suspected child pornography found in allocated space are not part of the present Indictment.
7. Mr. Young does not report in his General Investigation Report dated June 28, 2004, that he had difficulty getting the hard drive to be recognized by his forensic tower or that he discovered that the hard drive was not spinning. (U)
8. In June of 2004, Mr. Young obtained a bit-by-bit image copy of Mr. Heiser's hard drive.
9. The copy was stored on Mr. Young's computer hard drive, the evidence drive of the Forensic Recovery of Evidence Device.
10. EnCase prepared a report in connection with the investigation in this case which was approximately 100 pages. (U)
11. The Government has never provided the 100-page report to Heiser. (U)
12. The Berwick Police Department has lost the 100-page report. (U)
13. On November 1, 2004, Heiser filed a motion to compel discovery, seeking a mirror image of the computer hard drive along with copies of any software including disks which were seized from his residence on or about May 18, 2004. (U)
14. This court granted Heiser's discovery motion on December 16, 2004, and directed the parties to file a stipulated protective order within 20 days if the parties could agree upon the form. (U)
15. In December 2004, Mr. Young's computer hard drive, which contained the copy of the image from Defendant's hard drive and files from approximately 15 other cases that Mr. Young was working on suffered a catastrophic failure. (U)
16. "Mean Time to Failure" is a standard used in the computer industry to measure the reliability of hardware such as hard drives. (U)
17. Mr. Young's hard drive was less than two years old and well within the "Mean Time to Failure" rating for the drive, so he had no reason to expect the drive to fail without warning.
18. Upon the failure of Mr. Young's hard drive, Mr. Young in April 2005 tried to obtain another bit-by-bit copy from Heiser's hard drive.
19. Because of the poor condition of Defendant's hard drive, it also failed, and multiple attempts to make an image copy were unsuccessful. (U)
20. Mr. Young observed so many errors in the attempted re-imaging of Defendant's hard drive that he is of the opinion that the platters, or parts of the drive containing the magnetic material used to store the data, were damaged. (U)
21. Defendant's hard drive is no longer readable, and the Government has been unsuccessful in making another image copy of it. (U)
22. In Mr. Young's opinion, the hard drive has been physically damaged and cannot be made functional so that the data on it may be read and imaged. (U)
23. It is the standard practice of the Pennsylvania State Police to make an identical image copy of a computer hard drive from the original and to conduct tests solely on the image copy in order to maintain the integrity of the original evidence.
24. In the event that there is a failure of the image copy of a hard drive, it is the practice of the Pennsylvania State Police to re-image or make another bit-by-bit copy of the hard drive from the original evidence.
25. Mr. Young followed all Pennsylvania State Police evidence protocols and procedures in this case.
26. Mr. Young also made a bit-by-bit CD-ROM backup copy of Defendant's hard drive and provided that copy to the Berwick Police Department.
27. Mr Young was aware of this Court's order of January 7, 2005, a few days after it was signed which required the Government to provide Heiser with a bit-by-bit image copy of the hard drive.
28. Mr. Young intially believed that there was no need to re-image Defendant's hard drive after the evidence computer, F.R.E.D. hard drive, failed since the Berwick Police Department had previously been provided a copy.
29. Despite requests from Mr. Young, the Berwick Police Department has been unable to produce the backup copy, as well as the 100-page EnCase report generated in this case.
30. When Mr. Young realized that the Berwick Police Department backup copy was missing, he requested that the department return the original evidence to him, including Defendant's hard drive, so ...