Victoria had a new obstacle to overcome after her return to Russia: She was now part of the U.S. government's immigration database. If she were ever to return, the authorities would know she had visited the country with a U.S. citizen she met online previously. To overcome this potential problem, Victoria made some changes to her life. Equipped with her new English skills, she moved to Moscow with Anna and landed a job as an office assistant in an international oil company. She rented a small apartment in the suburbs and tried to make a living as best she could, but her champagne taste and poor money-management skills started to catch up to her.

A friend at work suggested that, with her looks, she could do some modeling for the many advertising agencies that were opening their doors as the Russian economy grew. She looked into it, and discovered her friend was right. Victoria was frequently hired for modeling assignments, which kept her away from her daughter for a longer part of the day. She quickly found out that modeling paid better than office work, so she moved full time into that job. In addition, she began "dating" clients of the modeling firm, enhancing her income even further.

A few years later, Victoria decided to change her name to Irina to fit the life she had developed in Moscow and to disconnect from her old self. She used a friend who worked in the government to obtain a new set of identity documents. However, age was catching up to Irina, and being a model over thirty was not well received in Russia. At that point, Irina knew what to do, how to do it and whom to target.

James Mitchell was a successful man. He was a senior pilot for one of the top three airline companies in the world, a decorated military captain, and he had a number of inventions and investments that made his life very comfortable. James's passion was flying; he was a young aviator and a graduate of the U.S. Navy Fighter Weapons School (also known as the Top Gun school), and, in his forties, he still relished the feel of an airplane under his command. As a senior pilot, he could select any route around the world, and would frequently swap with his peers to break up the monotony of flying to the same city again and again. Being a former Navy pilot, he had not lost the charisma and swagger that appealed to the ladies, despite being in a great deal of pain after the recent loss of his wife to a catastrophic illness. His friends encouraged him to start dating again, especially because he was still young. One of them convinced him to join an international dating Web site because he flew internationally so often. "Even if it doesn't turn up your soul mate," his friend told him, "at least you'll have someone to dine with the next time you're in, say, Moscow."

A few weeks later, James was planning for an upcoming flight to Moscow and decided to look into meeting a Russian woman online. Like his friend said, it would beat eating dinner alone. While browsing his potential matches on the Web site, Irina's photograph caught his eye. He read her online profile and was impressed by her level of success as a single mother. "What's the worst that could happen?" he thought as he sent her an Internet message.

Irina had become quite skilled in assessing the background and net worth of her clients and companions; small hints, like watches, shoes and clothing, would tell her the potential for a relationship in which the primary beneficiary was going to be her. When she met James at a restaurant named Dostoevsky in the Red Square district of Moscow, her interest was piqued. He was well-dressed, and she already knew from reading his Internet dating profile that he was a pilot. Things were looking up, but she wanted to play it safe and did not take the evening beyond dinner that first time. At the end of the meal, she gave her business card to James and suggested that he call if he wanted to have dinner again on his next visit.

A few weeks passed while James thought about his meeting with Irina and the nice conversation they had over dinner, and he decided to call her. He told her he was flying to Moscow again and invited her out a second time. She said she would be delighted and suggested they meet at the same restaurant. Irina knew she had a fish ready to bite and was going to try to hook it.

After their dinner, Irina asked James if he wanted to go dancing at a nearby club. Since he had taken a 36-hour layover, he knew he could safely have a drink or two and be ready to fly in time, so he agreed. By the end of the night, James was hooked and invited Irina to visit him at his home in Winnetka, Illinois. She submitted her passport to the U.S. authorities and was granted a 30-day visitor's visa.

It was early autumn and the leaves were just turning gold in the northern suburbs of Chicago, a beautiful time of year. James met Irina at O'Hare airport's immigration area and escorted her to his Mercedes; they drove to his house so she could rest from the 14-hour flight. As they passed through the double wrought iron gates of the driveway, Irina knew she had made a great catch. James showed her to her room and had his housekeeper take up her bag.

The next day, James took Irina on a tour of Chicago and some of its landmarks. During her 30-day visit, James became quite attached, and when it was time for her to leave, he proposed marriage. Irina was delighted by the prospect of finding someone who would take care of her for the rest of her life. But what she had not mentioned to James — and would not ever mention — was that she had developed a liking for much younger men and had a relationship in Moscow with a young college student named Sergei. In addition, her plan was not to marry and live happily ever after, but to marry and divorce, American style.

Irina returned to Moscow, and a few weeks later flew back to Chicago with Anna to marry James. After a small wedding, they settled into the Win-netka house. Irina began to implement her plan of action, and her first request was for a laptop computer, which James gladly purchased for her.

That June day began as most June days in Chicago — light rain in the morning and hot by early afternoon. Irina was busy on the Internet using instant messaging (IM) to chat with her family, friends and Sergei. The time difference between Chicago and Moscow was convenient because it was early in the day for her, no one was home, and she could chat for several hours, until it was time to decide what to do about dinner.

As the month wore on, Irina executed her plan. She constantly asked James if he would buy her a new car — almost to the point of annoyance — until she broke down his defenses and he agreed to buy her whatever car she wanted. As soon as she was able to go into the city and meet new people, she befriended a woman close to her age who was going through a bad divorce. Irina began to visit her new friend, Candace, and found out about her life. Candace described various problems that her former husband had saddled her with, like credit cards being maxed out, unpaid property taxes and other financial woes. As Irina heard more, she decided to research the things that could happen in American divorces, using the Internet as her primary research tool.

Three months later, she was ready to put her studies to the test. She picked a fight with James by accusing him of being unfaithful with a member of his crew, not an uncommon occurrence in the airline industry. During James's ordeal, she threw a number of household objects at him. Once the argument was in full swing, she called 911 and asked the police to come because her husband was being violent. When officers arrived, they asked James to leave for the rest of the day and spend the night at a hotel. James was confused and didn't understand what was going on; he initially thought there was a misunderstanding and called his new mother-in-law for advice on how to get along better with his wife. Irina's mother told him that the way to reassure Irina of his commitment to her was to adopt Anna. Being the devoted husband that he was, James began to look into the requirements.

Three months later, an attorney had prepared the adoption papers, and they were signed by James and Irina. The two had reconciled and were living under the same roof again. That lasted a short time before Irina began insisting on being added to the house title. At this point, James's patience was running out and he finally started to doubt his new wife's sincerity. He decided to contact an attorney; the attorney spoke to him about the legal implications of his actions so far and recommended that James also speak to an investigator who specialized in family law; he recommended my firm.

We decided on a two-pronged approach: a physical investigation and a forensic one, for which I was primarily in charge. The physical investigator, Carla Edwards, followed Irina for several days on her outings around the city, and one aspect of the daily routine caught her attention — Irina was visiting a number of different banks and branches around the city. To her, this seemed very peculiar since James said that she only had one bank account, which they shared, and did not have any business ties in the United States.

James's attorney, Dave Phillips, wanted me to see if there was any information of value on Irina's home computer. Dave was not very familiar with electronic evidence and asked me if there were any e-mails that indicated what Irina was thinking and with whom she was communicating.

As part of my standard procedure, I treated the electronic evidence as if it was going to be presented in court. My team and I began by photographing and documenting Irina's laptop, which James sent to us, and then created a forensic image of the hard drive. To do this, we removed the drive and connected it to a write-blocking device, which prevented information from being written to the hard disk, thus preventing modification or deletion of any data. Once the forensic image was created, we ran it through a software program that allowed us to view the contents of the hard drive and see data that was not normally visible to the computer user.

I discovered a familiar but disturbing sign of tampering — an eraser program had been run on the laptop. These types of programs are designed to permanently erase files from the hard drive without leaving any evidence of their existence. After this finding, I halted my normal routine and ran a program that searches for anti-forensic products, logic bombs and other nefarious tricks that attempt to destroy evidence during a forensic examination. Although the courts have determined that anti-forensic tools are evidence of self-incrimination in computer investigations, their presence complicates the processing of a case. The report generated by the software program confirmed the presence of anti-forensic tools, and the installation dates were just after Irina received the laptop from James. After discussing my findings with Dave, I began to treat the investigation as a criminal one and worked under the assumption that Irina was trained in sophisticated anti-forensic techniques.

My next step was to recover as many deleted files and file fragments from the hard drive as possible and prepare them for examination. This process took me 48 hours, but it yielded a treasure trove of deleted content and more than 90,000 pieces of evidence to be reviewed and examined, including — most important — Irina's Internet history files. It appeared that she had been regularly deleting her Internet history, but I was able to recover it; I saw the Web sites she was visiting and the full extent of her malicious behavior. In the recovered content, I found photographs, e-mails, online chats, access to foreign bank accounts and other files that began to paint a better picture of her activities while married to James. I uncovered the online research she conducted into divorce in the United States and ways to protect her interests. There were graphic e-mails and IMs she shared with Sergei, her Russian boyfriend, and even nude photographs of herself that she sent to him online. I found messages exchanged between Irina and her mother about persuading James to adopt Anna because it would result in child support and more alimony when Irina filed for divorce. And then there were transfers of money from the bank account she shared with James to multiple accounts in her name and those of her family members.

After several months of investigation, James had enough evidence against Irina to file a motion for annulment of his marriage in the Cook County Court, and a hearing date was set. It was unusual for marriages to be annulled, but in this case it would also terminate Irina's foreign spouse visa and reverse James's adoption of Anna.

I was the principal witness for the plaintiff in the annulment hearing and I walked the judge through the steps involved in locating the evidence on Irina's laptop and determining the dates she had accessed Web sites and sent messages. This was important because I was able to place Irina at the keyboard on the first day she received her computer, having an Internet chat with her lover in Russia, and sending explicit photos of herself. After one day of testimony, our side rested and it was time for the defense attorney to ask me questions. He had a difficult time rebutting the evidence, and most of his questions were related to the possibility of someone else placing the Internet history on the computer, for example, James, in order to avoid a potentially costly divorce. I was able to show the defense attorney how the time stamps ruled that out and explained how the process of imaging prevented the alteration of files. That was the end of the defense's questioning.

At the time, I did not know that an Assistant District Attorney (ADA) was listening to the particulars of this case in the back of the courtroom. About a week later, I received a call from the DA's office asking me to testify before the grand jury. Apparently, in the process of hiding her fraudulent intentions from James, Irina had broken several laws — including a few federal computer crimes statutes — and the DA was interested in prosecuting the case. I appeared before the grand jury a few months later and presented my evidence, and an indictment was returned for various offenses. After a warrant was issued for her arrest, Irina fled Illinois and was last heard of in California. A short time later, a notice of the annulment reached the Department of Homeland Security and her permanent residence card was revoked. A second arrest warrant, this one for a fugitive illegal alien, was issued for Irina. To date, she has not been located, but a car she stole from James was recovered in Arizona. I am confident that if she stays in the United States, Irina will eventually be caught.

Ernesto F. Rojas is the founder and president of Forensic & Security Services Inc., a firm specializing in electronic forensic investigations, extracting data from cell phones, GPS receivers and computer systems of all sizes. Its primary focus is in the fraud arena and cases that involve fraudulent data. Mr. Rojas has more than 25 years of experience in electronic and information systems and has done security-consulting work for private and government organizations. He is recognized as an expert witness in the state and federal courts. He may be reached at [email protected].