| The stories are true; the names and places have been | | | | good time to show up - said "I didn't spend two years |
| changed to protect the potentially guilty. | | | | marching up and down the God**m Ho Chi Minh Trail |
| A few years ago, Debby Johnson, an attorney from a | | | | for this s**t!" I understood. |
| large firm based in Kansas City, contacted me about a | | | | It turns out that opposing counsel had never gotten |
| relatively simple matter. I was to travel to offices in | | | | around to telling this group that a computer forensics |
| Sacramento from my San Francisco-area labs, copy a | | | | guy would be calling them and they needed to |
| computer's disk drive, and locate emails sent by the | | | | cooperate. I found that out when I told Debby of the |
| plaintiff to his brothers and sisters, of which he had | | | | righteous resistance I had come up against. She |
| nine. The case was a product liability lawsuit for an | | | | straightened it out with counsel and the next set of |
| amount in the tens of millions of dollars. The plaintiff | | | | phone calls I made to the sibs was a lot more |
| claimed that his health had been damaged by an | | | | congenial. |
| international firm's defective product, although he was | | | | The next several days, traveling from state to state, |
| symptom-free at the moment. What was the | | | | town to town, brother to sister to brother and on and |
| product? Let's say it was coffee. | | | | on to copy the private data of nine innocent family |
| From the cool Bay Area in summer, I traveled to | | | | members had its challenges. But that's a story unto |
| downtown Sacramento, where it was a balmy 106 | | | | itself...I'll spare you most of the details. Upon my return, |
| degrees. I knew I was sweating, but inside I was cool. I | | | | the protocol called for me to search all of the data for |
| wondered if someone else would be in hot water | | | | any correspondence from - let's call him "The Brother" |
| soon. | | | | that referenced his struggles with ... we're calling it |
| It is not unusual for me to never meet my client, for | | | | Coffee. I was then to print out the references I found, |
| computers can be shipped to me at my lab, but Debby | | | | and send a copy both to the judge and to opposing |
| was there in the law offices of the plaintiff's attorney. | | | | counsel for privilege and relevance review. Debby and |
| In an oak-paneled conference room we met with | | | | her firm were not to get a look at the data until |
| counsel for "the other side" and with the plaintiff | | | | anything either private or irrelevant had been picked |
| himself. He sat smugly with his shiny computer on the | | | | out, and only the remainder produced. |
| conference table, friendly enough in spite of his | | | | What did I find? Around the time of the alleged emails, |
| contention that I would never find the offending emails | | | | lo and behold, I found actual emails. The whole family |
| he had allegedly sent years before. My client believed | | | | was talking about The Brother's struggle with Coffee, |
| that this fellow had sent emails to his siblings that | | | | their individual investigations into Coffee, and the |
| would disprove his contention - that would show him to | | | | upcoming lawsuit about Coffee. At one point, one email |
| be making up a case to snag a cool few ten millions. | | | | pointed out that this guy Burgess was going to be |
| I removed the hard disk from our man's system to | | | | looking into everyone's email, and wouldn't it make |
| make a forensic copy to work with and analyze. I was | | | | sense not to talk about Coffee? They agreed. They |
| surprised to find that the hard disk was 100GB in size. | | | | now spoke only of ... "the C-Word." |
| A drive of that capacity was fairly new and unusual to | | | | What else did I find when I performed my electronic |
| see in a case this soon after it had come on the | | | | discovery and digital forensic analysis? Well, for the |
| market. I was prepared for a much smaller disk drive, | | | | most part, I just can't talk about it. There are some |
| as I had been told I'd be seeing one about 20% the | | | | things on your computer you wouldn't want me talking |
| size. Fortunately, there was an electronics superstore | | | | about, I'm sure. There are things on my computer I |
| nearby, so I doffed my suit jacket, cranked up the air | | | | wouldn't want me talking about either! E-discovery |
| conditioning on my minivan / lab wagon (that beauty | | | | often has to be a pretty private process. |
| just turned over 200,000 miles on the day I'm writing | | | | But there was one particularly interesting finding. When |
| this), and headed on over for a bit of new gear. | | | | I called the Green Beret Brother (GBB) from his sister's |
| Forty-five minutes and a bit of melted rubber later I | | | | place across town, and asked for permission to head |
| arrived back at the scene to forensically clean the | | | | on over to make the copy of his computer, he |
| new disk drive by writing zeroes to every sector.. | | | | obligingly told me it was okay. When I got there, he first |
| Once cleared to my satisfaction, I set up the copy | | | | asked me to read and sign a statement that I wouldn't |
| process. In those days, while I was partial to | | | | hold him liable for any damage to me or my equipment |
| Diskology's Disk Jockey, the version I had then didn't | | | | - unintentional or otherwise. Well that was a little scary |
| seem to be able to handle what was such a large | | | | coming from a guy trained in the arts of stealth, war, |
| drive for the time. I probably used Byte Back on a | | | | and undoubtedly the garrote. But as the paper didn't |
| forensic Intel box I had brought just in case. I began the | | | | seem like a legal document, I signed it, if that was what |
| copy process and it went without a hitch. But while the | | | | would get me in to do my work. He was pleasant |
| copy was proceeding, I began to wonder - wasn't this | | | | enough, the music he had on was good, and the copy |
| a pretty big drive to have been around at the time of | | | | went without a hitch. And I left alive and undamaged - |
| the alleged emails? And for that matter, wasn't this | | | | a plus, indeed! |
| computer pretty fast for its age. And did Windows XP | | | | Once in my lab, I discovered the last thing that had |
| really come on the market before these emails were | | | | happened on his computer. About one minute after my |
| to have been written? I was beginning to suspect that | | | | phone call for permission to go over, GBB had sent |
| the game was rigged, and that I never would find the | | | | himself an email and then immediately deleted it. The |
| plaintiff's deleted emails on that computer. | | | | subject, all in caps, was "COFFEE!" No "C-Word" |
| I discussed the matter with Debby. I guessed that the | | | | fooling around for him. The message in the body was |
| plaintiff was right about the task being futile - because I | | | | simple and succinct: "If you find this email, F*** YOU!!!!!" |
| guessed that the offending emails were never on this | | | | It's nice when a person knows how he feels and is |
| computer. I said I'd be willing to look for them, but I didn't | | | | able to express it freely. There was also a deleted |
| want to waste my client's cash. Debby asked me to | | | | photograph attached to the deleted email. Upon |
| look into the matter of the components' age when I | | | | recovering same, it turned out to be a very recent |
| got back to HQ. A few inquiries with the manufacturer | | | | photo of an extended middle finger - presumably |
| and a couple of Google searches later, I was pretty | | | | GBB's finger. Visual aids are always helpful in |
| well convinced that the fellow had never written those | | | | understanding the subject matter, don't you think? |
| emails on this computer. Windows XP was almost too | | | | In the end, I produced about 75 pages of |
| new, the disk drive was a couple of weeks too | | | | documentation I thought relevant. Of course, I had to |
| modern, and the computer was a month or two | | | | include GBB's missive. As expected opposing counsel |
| younger than those emails. | | | | called everything irrelevant or privileged. Also as |
| Debby called opposing counsel - who had no idea why | | | | expected, the judge allowed all of the documents I had |
| this might not be the original system...until he checked | | | | produced - with a number of lines redacted - to be |
| with his man. Turns out he had "set it on the curb for | | | | delivered to my client. Everyone's favorite was the |
| trash pickup" because it "wasn't working." The | | | | literate bit produced by GBB. |
| attorneys weren't happy. The court wasn't happy. The | | | | As for The Brother - the court decided that not only |
| only solution was for me to go to the nine brothers | | | | was he not very honest, due to the destruction of the |
| and sisters in four states to copy their personal | | | | most important data in the case - his original computer |
| computers and sift through those for the offending | | | | - but the evidence and the relevant emails showed him |
| emails. | | | | to be apparently undamaged by the Coffee. The case |
| Do you think they were happy to hear from me? | | | | went to defeat, Debby and her firm were happy, and |
| Would you be if your brother put you on the spot like | | | | GBB became a legend. |
| that? Each of them had to agree that a perfect | | | | This is just one of the many "CSI* - Computer |
| stranger - one who was working against their beloved | | | | Forensics Files: Real Cases from Burgess Forensics". |
| brother - could come into their homes and look through | | | | Stay tuned for more stories of deceit uncovered by |
| everything on their personal computers. The most | | | | computer forensics. |
| telling example of their displeasure was from one | | | | *The Free Dictionary lists more than 160 definitions for |
| brother, a former Viet Name-era Green Beret, who - in | | | | CSI at We choose Computer Scene Investigation. |
| response to my phone call asking when would be a | | | | |