Computer Forensics in a Criminal Investigation: How a Floppy Disk Caught the BTK Killer (Two-Page Report)

Assignment: Computer forensics in a criminal investigation

Research and write a two-page report about a criminal investigation that was successful largely due to the application of computer forensics.

Original example for study purposes (about 800 words, roughly two double-spaced pages without references).

The BTK Investigation: How Computer Forensics Caught a Serial Killer

Introduction

Computer forensics is the identification, preservation, analysis and presentation of digital evidence in a way that is legally acceptable. One of the most famous examples of its power is the capture of Dennis Rader, the “BTK” (bind, torture, kill) serial killer who murdered ten people in and around Wichita, Kansas, between 1974 and 1991. For three decades, Rader evaded police while taunting them with letters. In 2005, a single deleted file on a floppy disk led investigators to his door. This report describes the case, the forensic techniques used and the lessons it offers.

Background of the Case

BTK’s crimes stopped for many years, and the case went cold. In 2004, after a local newspaper marked the 30th anniversary of his first murders, Rader resumed communicating with police and media, sending letters, puzzles and packages. Lieutenant Ken Landwehr led the renewed task force, which worked with computer forensic examiner Randy Stone (Kalat, 2019). In one message, Rader asked police whether he could communicate by floppy disk without being traced. Police answered, through a newspaper classified ad, that it would be safe.

The Digital Evidence

On February 16, 2005, Wichita television station KAKE received a package containing a 1.44 MB floppy disk, photocopies related to the crimes and a victim’s necklace. The disk contained one visible file, “TestA.rtf,” with the killer’s usual messages. However, when the disk was examined with the forensic software EnCase, investigators found that it had previously held a deleted file: a document related to a meeting of the Christ Lutheran Church council. The document’s metadata showed it had last been saved by a user named “Dennis” (Kalat, 2019).

This was possible because of how file systems work. When a file is deleted, the operating system usually marks its space as available but does not immediately erase the data, and document files contain metadata, such as author names, organization names and editing history, that users rarely see. Forensic tools can recover deleted data and read this hidden information. Rader, who had borrowed the disk from his church, apparently did not realize that it carried this digital fingerprint. Earlier, he had given the pastor a disk containing a council agenda to print, which further connected him to the church computer (Cohen, 2005).

From Digital Lead to Arrest

An internet search of the church’s website showed that Dennis Rader was the president of the church council. Investigators drove by his home and saw a black Jeep Cherokee similar to one captured on surveillance video near a location where BTK had left a package (Kalat, 2019). Digital evidence identified a suspect, but investigators needed physical confirmation. They obtained a DNA sample from a medical specimen of Rader’s daughter, which showed a familial match to DNA from a crime scene (Cohen, 2005; Kalat, 2019). Rader was arrested on February 25, 2005, and confessed. He pleaded guilty to ten murders in June 2005 and was sentenced to ten consecutive life sentences.

Why Computer Forensics Was Decisive

For more than 30 years, traditional methods, including witness interviews, handwriting analysis and physical evidence, had failed to identify BTK. Computer forensics succeeded for several reasons. First, the disk was examined with an established forensic tool; standard practice is to preserve the original, analyze a forensic image and document the chain of custody so that evidence holds up in court. Second, they looked beyond the visible content to deleted data and metadata. Third, the digital lead was corroborated by independent evidence, the vehicle and the DNA, which is a best practice in forensic investigations. The case shows that digital evidence often works best as a lead that narrows the search, which is then confirmed by other evidence.

Lessons and Significance

The BTK case is still used in training because it illustrates core principles. Digital devices retain far more information than users realize; deleted does not mean destroyed. Metadata can link a file to a person, organization or computer. Chain of custody and forensic imaging protect the integrity of evidence. Finally, the case raised ethical questions about investigative methods, such as police assuring Rader that a disk was untraceable and obtaining a relative’s medical sample, which continue to be debated, especially as familial DNA searching expands. Today, forensic examiners analyze smartphones, cloud accounts and social media, but the principle that small digital traces can solve major crimes remains the same.

Conclusion

The capture of Dennis Rader shows how computer forensics can break open a case that had remained unsolved for decades. A deleted church document and its metadata, recovered with forensic software, identified a suspect within days, and corroborating evidence led to his arrest and conviction. The case remains a powerful example of why investigators must understand and properly handle digital evidence.

References

Cohen, S. (2005, March 4). Computer disk, DNA and messages helped lead police to BTK suspect. Lawrence Journal-World (Associated Press). https://www2.ljworld.com/news/2005/mar/04/computer_disk_dna/

Kalat, D. (2019, October 7). Nervous system: How legal tech helped catch the BTK killer. Berkeley Research Group (originally published in Legaltech News). https://www.thinkbrg.com/insights/publications/nervous-system-how-legal-tech-helped-catch-the-btk-killer/

More model assignments posted today

• Friends vs. acquaintances (Simon Sinek)
• ADHD psychiatric evaluation (Sarah Higgins)
• Three 2018 data breaches
• ITHBC literature review
• Sentinel event internal memo
• "Aha! and Huh?" structured literacy
• ABS instructional strategies toolkit
• Middle childhood friendships
• Kohlberg moral dilemma
• Nursing informatics competencies