When Forensic Testing Matters: How Untested Assumptions Led to a Reversed Custody Order

By Lance Sloves, CCE, CCME | Computer Forensic Services, Inc.

In digital forensics, there's a critical difference between observing that something could have happened and proving that it did happen. That distinction was at the heart of a custody case that went all the way to the Fifth District Court of Appeals in Dallas — and the appellate court's 2022 opinion serves as a textbook example of why forensic testing matters.

The Case

During a contested divorce and custody proceeding in Collin County, the mother alleged that the father had intentionally destroyed digital evidence on his iPad and MacBook Pro in violation of a preservation agreement. Specifically, she claimed that a data-wiping application called Dr. Fone Erase had been used to delete data from the iPad, and that approximately 15,000 files had been moved to the trash folder on his MacBook Pro.

Based on these allegations, the trial court imposed one of the most severe spoliation sanctions available: it presumed that the destroyed evidence would have shown the father possessed illegal pornographic material and was engaging in inappropriate sexual contact with minors. That presumption became a cornerstone of the court's decision to deviate from the standard possession order and require fully supervised visitation.

The father appealed.

Two Experts, Two Approaches

The case featured testimony from two digital forensics experts — and the contrast between their methodologies proved decisive on appeal.

The opposing expert examined forensic images of the father's devices and observed that Dr. Fone Erase had been installed as part of the Dr. Fone software suite and was executed on the iPad in May 2018. She concluded that data had been deleted. However, she acknowledged several critical gaps in her analysis: she noted that Dr. Fone Erase was still in the trial version on the device; she did not test the Dr. Fone application in this case; she could not recover any files allegedly erased by the application; and she did not know what, if anything, was actually deleted.

Our approach at CFSI was different. Rather than simply noting that the software was present and had been executed, we purchased the Dr. Fone Recover application — the same product the father had purchased — and downloaded it. The download automatically included four modules, including Dr. Fone Erase, with no option to download only the Recover module. We then ran the Erase application through its process. The result: the trial version ran to completion and then displayed a message requiring the purchase of an additional activation module before any data could actually be erased.

In other words, executing the trial version of Dr. Fone Erase did not — and could not — delete data from the device.

The Forensic Imaging Timeline

Another critical factor was the timing of the forensic imaging. CFSI created forensic images of all five of the father's electronic devices in March 2018, pursuant to the preservation agreement reached at the father's deposition the previous month. Those forensic images captured a complete snapshot of the devices before any of the alleged spoliation occurred.

Our analysis of those images found no evidence of child pornography, no improper communications with minors, and no illegal content of any kind. The opposing expert — who received copies of our forensic images and analyzed them under a court-ordered protocol specifically directing her to search for obscene material involving minors — never disputed those findings.

This is a fundamental point the appeals court emphasized: if the forensic images taken before any alleged deletion contained no illegal material, there was no evidentiary basis to presume that deleted material was illegal.

What the Appeals Court Found

The Fifth District Court of Appeals reversed the trial court's spoliation finding and the custody determinations that depended on it. The court's reasoning highlighted several key forensic principles:

Testing matters. The appeals court credited the testimony that the trial version of Dr. Fone Erase could not actually erase data, based on hands-on testing of the application. The opposing expert's assumption that execution equaled deletion was unsupported.

Forensic baselines are invaluable. Because forensic images were created before the alleged spoliation, there was a verifiable baseline showing what was — and was not — on the devices. The court noted that no evidence of illegal material existed on those baseline images.

Moving files to the trash is not permanent deletion. The opposing expert acknowledged that the approximately 15,000 files moved to the MacBook Pro's trash folder were still accessible and had not been permanently deleted. She never testified that any of those files contained illegal content.

Sanctions must be proportionate to the evidence. Even assuming some duty to preserve was breached, the court found the sanction — presuming possession of illegal pornography and sexual contact with minors — was excessive and unsupported by any evidence in the record.

The court concluded that the spoliation finding "probably caused the rendition of an improper judgment," reversed the conservatorship, access and possession, and attorney's fee provisions, and remanded the case for a new trial.

Lessons for Attorneys

This case offers several important takeaways for attorneys handling cases involving digital evidence:

Image early. Creating forensic images at the earliest possible stage of litigation establishes a baseline that can be invaluable if spoliation is alleged later. In this case, the March 2018 images were the single most important piece of evidence in defeating the spoliation claim.

Demand testing, not assumptions. When an opposing expert testifies that data was destroyed, ask whether they actually tested the mechanism of destruction. There's a significant difference between "this application was executed" and "this application successfully deleted data." Software artifacts, log files, and execution traces don't always mean what they appear to mean at first glance.

Understand the technology. Many consumer applications bundle multiple tools together, install trial versions automatically, and leave behind execution logs even when no substantive action was taken. A forensic expert who understands these software behaviors can prevent unfounded conclusions from driving your case.

Challenge disproportionate sanctions. Spoliation sanctions must be proportionate to the evidence of what was actually lost. A presumption that destroyed evidence contained the worst possible content is only appropriate when there is some independent evidence supporting that inference.

Our Approach at CFSI

At Computer Forensic Services, we believe that forensic conclusions must be grounded in testing and evidence — not assumptions. When we encounter an artifact on a device, we don't stop at identifying it. We test it. We replicate the conditions. We determine what actually happened, not just what could have happened.

That methodology made the difference in this case, and it's the standard we apply to every engagement — whether we're supporting criminal defense, civil litigation, family law matters, or corporate investigations.

Computer Forensic Services, Inc. (CFSI) is a Dallas-based digital forensics firm providing expert analysis and testimony in criminal, civil, and family law matters across Texas and surrounding states. For more information, visit cfsiusa.com or contact us to discuss your case.

Case Reference: In the Interest of H.B.R., No. 05-20-00219-CV, Fifth District Court of Appeals, Dallas (June 1, 2022)

---

This article was prepared by Computer Forensic Services, Inc. (CFSI) with AI-assisted research and drafting. All content has been reviewed for accuracy by CFSI's certified forensic examiners.