A computer in normal use deletes and overwrites files, especially temporary files like browser caches, so you don’t investigate by logging in and reading files. You can copy non-deleted files to a USB drive, but that doesn’t help much either. It’s the deleted stuff they want.

The best method is to shut it down immediately, before the OS or another user can make any more changes, then remove the disk and do forensic analysis.

They already knew about the changes to her Myspace profile. They believed she made the changes from a computer in the library. So they were looking for evidence she was in the library, what time she was there, plus anything else she did while on the computer. Anything else that would give clues to where she went and why. Browser caches keep all kinds of stuff, and computer forensics can find lots of info that has been erased and overwritten.

I assume it didn’t take long to get a warrant for that.

This way, we were never plagued with viruses or problems, and no warrant would ever matter. All a patron had to do was reboot before they walked away. If somebody showed up with a warrant (and they did at least once when I was there) all they would get are the sign in logs of who used the lab. There wasn’t even a log as to who used which computer.

For those who suggested that the cops should have used the machines as patrons, there are numerous potential problems with this. First, Library conputers generally have very high security levels; one patron cannot generally view the browsing history of another (if the references to coming across another user’s already logged in e-mail are related to library computers then I guess this isn’t universal, but I’m guessing such lapses are the exception) Second, all the libraries around here have limits of one hour and restrictions about use by people without library cards. This would make it very difficult for police to find anything useful, especially if other patrons were waiting.

I think readers should hold off on their knee-jerk reactions and recognize that a)this case is a little more complex than some responders are acknowledging, and b) in the heat of the moment people often respond emotionally rather than logically thinking through all the possible long-term implications of their immediate actions.

Besides, if the information was *that* vital, why’d it take eight hours to get a warrant?

Let’s be clear: There’s no library privacy issue here. The police were not seeking borrower records of any sort. There is no expectation of privacy in internet use on a public terminal because the user is sitting in a public place at the time. Librarians can and do look over patrons’ shoulders to see what they’re doing. I suspect that if a patron in the Randolph library had been accessing porn or white-supremacy websites, this librarian would not have hesitated to violate his privacy and shut him down.

So if there are no actual interests being protected, the librarian is just a self-righteous twit who thinks that sticking it to the Man relieves her of any obligation to use good judgment. She better hope that there wasn’t any information on that computer that would have allowed the police to head off a meeting between the girl and her uncle during the eight-hour wait. If there was, then she doomed that girl to die.