Daviess County Sheriff’s Department Special Deputy Cheryl Purdy, who specializes in examining phones for data and hidden material, helped the Federal Bureau of Investigations send an Ohio County man to federal prison for 30 years on charges of creating and possessing child pornography.
Purdy’s work led to the man pleading guilty to the charges in late January in U.S. District Court in Owensboro. The plea agreement was accepted by the judge, who sentenced him to 30 years in prison.
While the man’s name is public record, the U.S. Attorney’s office requested the man’s name be withheld to avoid inadvertently identifying the victim.
“Her quick response to this crime allowed for (the perpetrator) to be identified when she located an image that captured (the perpetrator’s) face in one of the deleted files,” FBI Special Agent in Charge James R. Brown Jr. wrote in a letter of appreciation to the sheriff’s office. “She was also able to recover a file that captured (his) voice as well.”
Purdy retired from Daviess County Public Schools and became a computer forensics analyst after receiving training at the state Department of Criminal Justice Training in Richmond.
Purdy worked for several years at the Owensboro Police Department, doing analysis one day a week while also teaching computer forensics at Owensboro Community & Technical College. Purdy is pursuing a PhD in digital forensics.
Purdy works as a volunteer special deputy with the sheriff’s office but still consults regularly with other analysts at OPD and the Kentucky State Police. The analysts use each other to peer review work on investigations, Purdy said.
“There’s no one that knows it all,” Purdy said.
The FBI requested Purdy examine evidence in the child pornography case. She said the FBI has a Regional Computer Forensic Laboratory in Louisville, but the facilities across the country have large loads of evidence waiting to be examined.
“The backlog (at the labs) is amazing. It’s unbelievable because there are so few in the country,” Purdy said last week.
She was asked to examine the phone in the interest of advancing the case.
Purdy said she received a micro SD storage card and began an analysis. The software detected the presence of files the man had attempted to delete.
Deleting a file is not really removing it entirely, Purdy said. Rather, the person is only deleting the file’s listing in the device’s directory. But, “until it has been overwritten, it still exists,” she said.
The software Purdy used was able to find the hexadecimal “file header” for jpeg and other files the man had attempted to delete, Purdy said. The software was then able to “reconstruct” the deleted files.
Because of Purdy’s findings, federal prosecutors were able to indict the man for producing and possessing child pornography. The hash values, which are like a digital fingerprint, were checked through the National Center for Missing and Exploited Children database but the images did not match any files of known trafficked child pornography, Purdy said.
When asked if conducting searches for images of child pornography was difficult, Purdy said, “sometimes it’s hard to stay middle-of-the-road” and objective, and not “in your own mind find this person guilty.” But an investigation can also exonerate a person if there are no images to be found, she said.
The plea agreement was not the first time Purdy successfully assisted the FBI on a case by finding digital evidence.
“There have been several,” Purdy said. “There are three I have done that have resulted in convictions, that I know of.”
The U.S. The Attorney’s office in Louisville declined to comment on the case, saying officials had chosen not to comment out of respect for the victim and family’s privacy.
Major Barry Smith, chief deputy for the sheriff’s department, said Purdy has provided evidence in a number of important investigations for the agency.
“She’s a tremendous (asset) for us when it comes to getting forensic data from cell phones and other devices,” Smith said.
“Her position is an unpaid position,” Smith said. “She volunteers her time. Someone of her expertise to provide her services is quite valuable.”
James Mayse, 270-691-7303, firstname.lastname@example.org, Twitter: @JamesMayse