CSI Computer Forensics - real cases of Burgess Forensics # 12 - Judgement of the computer was lost

The stories are true, names and places have been changed to protect the potentially guilty.

Some years ago, Debby Johnson contacted a lawyer for a large firm in Kansas City, tell me about a relatively simple matter. I was traveling to Sacramento to San Francisco office labs from my area, copying a computer drive, and locate emails sent by nine actors, his brothers and sisters, which he. The case was a product liability claim for an amount intens of millions of dollars. The appellant argued that his health was damaged by a defective product international society, even though he was without symptoms at the time. What was the question? Let's say it was coffee.

Fresh from the Bay Area in the summer I traveled to Sacramento, where he was a mild 106 degrees. I knew I was sweating, but inside I was cool. I was wondering if anyone is in hot water soon.

It is not uncommon for clients I never meet,Computers can be sent to me in my lab, but Debby was there in the office of a lawyer for the plaintiff. In an oak-paneled conference room we met with counsel for the "other side" and the actor. He sat smugly with his shiny computer on the conference table, friendly enough, despite his statement that I would never find the offending e-mail he had sent years before. My client believes that this guy had brothers and sisters, e-mail sent to her, thatto refute his claim - that would have him make a show-case in a cool book about ten million.

I removed the system disk from our man is a legal copy of working and analyzing to do. I was surprised that the HDD is 100GB in size. A ride with this ability was completely new and unusual in a case of seeing the same shortly after they arrived at the market. I was ready for a much smaller hard drive as I was told that there would be more than 20% of the size. Fortunately,There was an electronics store nearby, so I took off my jacket, the air conditioning cranking on my minivan / lab mix (shot this beauty more than 200,000 miles on the day I wrote this), and over the tip I am a bit of new gear. Forty-five minutes and a bit 'of melted rubber later I returned to the scene to clean the new forensic disk write zeros to every sector ..

Once settled my satisfaction, I have the copy process. In those days, when Ipartially Diskology's Disk Jockey, the version that had apparently not be able to handle that large a hard drive for time. I probably used Byte Back box led to a forensic Intel have just in case. I started the copy process and it went smoothly. But it was during the copy process, I began to wonder - was not large enough to be a race was around the time of the alleged e-mail? And besides, this machine was not fast enough for his age. It has WindowsXP really come on the market before these emails were written? I began to suspect that the game was handled, and I never found the applicant that the computer deleted e-mails about.

I discussed the matter with Debby. I suspect that the plaintiff is entitled to the hopeless task - because I suspect that your computer insulting e-mails were never on. I said I would be willing to try it, but I did not want to waste my MCC 's money. "Debby asked me to issue 'age of the components look like when I went back to HQ. Some questions to producers and Google searches later, I was pretty convinced that the boy had never been such an email written on the subject computer. Windows XP was almost new hard drive was a couple of weeks too modern, and the computer has one or two months younger than the e-mail.

Debby called opposing counsel - who have no idea why this was not theoriginal system ... until he checked with his man. If it is found that has "set on the curb for garbage collection" because it is not "work". The lawyers were not happy. The judge was not happy. The only solution was for me to go with nine brothers and sisters in four states to copy their personal computers to sift and that non-compliant e-mail.

Do you think they were happy to hear from me? You, if you put your brother on the spot like that? Each of them had agreed that aPerfect Stranger - one that worked against their beloved brother - could come to their homes and look through everything on their computers. The most significant example of their displeasure was a brother, a former Viet Name-Green Beret who had to ask - in reply to my phone, When would be a good time to show his call up Said - "If I had to two years marching up and down the God ** m Ho Chi Minh for this s ** t! "I see.

It turns out that a lawyer opponentnever had to say to this group, which is a type of computer forensics, he exclaims, and they needed to cooperate. I discovered that when I told Debby of the righteous resistance, I would have come. It 'was directed by council and the next round of phone calls I was much more sympathetic brothers.

The next day, traveling from state to state, town to town, brother, sister, brother and on and on private data of nine innocent family copyThe members had its challenges. But this is a different story ... I spare most of the details. After my return, as the protocol for me to get all the data to search for a match - we call him "brother" that refers to his struggle with ... We call it coffee. I was then printed references I found, and send a copy of both the judge and lawyer earlier review for privilege and relevance. Debby and her company do not get a look at the data until allprivate or irrelevant had been collected and produced only the remainder.

What did I find? Around the time of the alleged e-mail, and behold, I found an e-mail itself. The whole family was talking about his brother's struggle with Coffee, their individual investigations into Coffee, and coffee imminent action. At one point, pointed out that an e-mail this Guy Burgess wanted to check in every email, and it makes no sense not to mention the coffee?They agreed. You spoke just now of ... "C-word."

What I found when I made my discovery of electronic and digital forensics? Now for the most part, I can not talk about it. There are some things on your computer would not talk about me, I'm sure. There are things on my computer does not even want to talk! E-discovery often has to be a process rather than private.

But it was a very interesting finding. When Icalled Green Beret Brother (GBB) from his sister's place in the city, and requested permission to head to a computer to copy from him, willingly told me it was okay. When I arrived there, he first asked me to read and sign a statement that I have not liable for damages to me or my equipment - whether intentional or unintentional. Well, that was a little 'fear of a young man trained in the art of camouflage, war, and no doubt strangulation. But as the paper does not seemas a legal document I signed, if that's what I do in my work. He was friendly enough, the music he had was good, and copying nothing happened. And I left alive and undamaged - a plus, yes!

Once in my lab, I discovered last thing that happened was his computer. About a minute to go after my call to be allowed through, GBB had sent an e-mail and then immediately deleted. The subject was in all caps, "Coffee!" No "C-word 'joke for him. The body of the message was simple and concise: "If this email, find f *** you !!!!!" And 'nice when a person knows how he feels and is able to express it freely. There was also a deleted photos attached, the deleted email. After the restoration of that turned out to be a very current picture of an extended middle finger - presumably GBB finger. visual aids are always useful to understand the topic, do not you think?

Eventually, I produced about 75Pages of documentation I thought relevant. Of course I had to point GBB belong. As expected defender called everything irrelevant or privileged. Also as expected, were able to judge all the documents I had produced - with a series of lines blacked out - they will receive my order. everyone's favorite was the production of the piece consists of GBB.

As for his brother - The Court held that not only he was not entirely honest, because of the destruction of key datathe case - his original computer - but the evidence and e-mail has proven to be him apparently intact from coffee. The case went to defeat, Debby and her firm were happy, and GBB became a legend.

This is just one of many "CSI * - Computer Forensics Files: real cases taken from Burgess Forensics". Stay for more stories of fraud discovered by forensic turn.

* The Free Dictionary lists more than 160 definitions for CSIacronyms.thefreedictionary.com. We choose Computer Scene Investigation.

Thanks To : MP3 Player wirelessinkjetprinter plantronicsbluetooth