Disk Jockey Training
Product Liability Computer Forensics Secrets
Copyright (c) 2008 Steve Burgess
A few years ago, Debby Johnson, an attorney for a large company based in Kansas City, contacted me about a relatively simple matter. I was going to travel to offices in Sacramento from my San Francisco Labs area, copy the disk drive of a computer, and locate emails sent by the applicant to his 9 brothers and sisters. The case was a products liability claim for tens of millions of dollars. The plaintiff claimed that his health had been damaged by a defective product international company, but was free of symptoms in the time. What was the product? Let's say that was coffee.
From the cool Bay Area in summer, I traveled to downtown Sacramento, where he was a balmy 106 degrees. I knew I was sweating, but inside I was cold. I wondered if someone would be in hot water before.
It is not unusual for me not to meet my client, for computers can be sent to me in my lab, but Debby was there in the complainant's lawyer's office. In a conference room with panels oak met with lawyers for the "other side" and the applicant himself. Although it was warm, the expression on his face was smug as he informed me that I would never find offending e-mails on your computer. My client believes that this man had sent emails to their brothers refute his claim – that show how to make a case to a cool little hook million ten.
I took the drive of the computer smug fellow make a copy of forensic work. I was surprised to find that the hard drive was 100 GB in size. A unit of that capacity was fairly new and unusual to see in those days. It was supposed to be 20 GB or less. Fortunately, there was an electronics superstore nearby, so I took off my jacket, influenced by the air conditioning laboratory in my car (that beauty just turned over 200,000) and headed over any new equipment. 45 minutes and a little more melted rubber He later returned to the scene to clean up forensic drive new writing zeros to all sectors.
Once cleared my satisfaction, I can configure the copy process. In those days, while I was in partial Diskology Disk Jockey, the version I had, therefore, does not seem to be able to handle what was a unit large at the moment. I ByteBack a forensic Intel box I had brought just in case. I started the process of copying and went without a hitch. Even so, I started to wonder – was not a very big drive to have existed at the time of the alleged emails? And for that matter, was not this computer pretty fast for his age. And Windows XP really come on the market before these emails were written? It seemed that they would not be any mail in this box.
I talked to Debby. I assumed that the plaintiff was right about the task being futile – because the offender never emails on this computer. I was willing to look, but I would not lose money from my client. Debby asked me to consider the question of the age of the components when I returned to the parent. A few investigations the manufacturer and a couple of Google searches later, I discovered that Windows XP was almost too new, the hard drive was a couple of weeks too modern, and the team was a month or two younger than those emails.
Debby called opposing counsel – who had no idea why this might not be the system original – until he consulted with her man. It turns out that he had "caught the curb for trash" because it "was not working." The lawyers were not happy. The court was not happy. The only solution was for me to go to the nine brothers and sisters in four states to copy their personal computers and sift via email to the infringer.
Do you think they were happy to know about me? Would you if your brother got in trouble as well? Each of them had to recognize that a perfect stranger – one that was working against their beloved brother – could come into their homes and search through everything in their computers personal. The most telling example of his dissatisfaction was a brother, a former Viet Name era Green Beret, who – in response to my phone call asking when would be a good time to appear – said: "I spent two years marching up and down the God ** m Ho Chi Minh for this s ** t!" I understood.
It turns out that no one had ever come to tell this group is called a small team and they had to cooperate. I find that when I told Debby of the righteous resistance had come against. The brothers were a little friendlier, once had the word of his brother's lawyer.
The next few days, traveling from one state to another, one city to another, from brother to brother and sister again and again to copy the private data of nine innocent family members had its challenges. But that is a story unto same … I save most of the details. Upon my return, the protocol called for me to find all matching data – let's call him "Brother" referring to his struggles with … We are calling it "coffee." The next task was to print what he had found and get the "other side "and the judge detrmine if something was private or privileged information. Debby and his company were not to take a look at the data until anything either private or irrelevant had been chosen, and only the remainder produced.
What did I find? At the time of the alleged emails, behold, I found e-mails real. The whole family was talking about the struggle of the coffee brother, their individual investigations into Coffee, and the forthcoming trial on coffee. At one point, a email Burgess said that this type would be looking at all the e-mail, and do not make sense not to speak of 'coffee'? Were agree. Currently, only spoke of … "The C-Word."
You simply can not talk about most other things I've found. There are some things on your computer you would not want me talking, I'm sure. The same with my own computer.
But there was a particularly interesting finding. When I called the Green Beret Brother (GBB) from his sister's house in the city, and requested permission to head on over to back his team, who kindly told me he was fine. When I arrived there, he asked me to first read and sign a statement that I would not responsible for any damage to me or my team – intentional or not. Well, that was a little scary coming from a guy trained in the art of stealth, war, and undoubtedly the garrote. Still, I signed it, if that was what was needed to let me do my work. Everything went well. And I left alive and in good condition – one more, indeed!
Once in my lab, I discovered the last thing that had happened on your computer. About a minute after my phone call for permission to go over, GBB had sent an email and then immediately removed. The theme, all caps, was "COFFEE!" No "C-Word" wasting time for him. The message that the body was simple and concise: "If you find this message, F *** YOU !!!!!" Full self-expression is a wonderful thing. There was also a deleted photograph attached to the e-mail eliminated. It was a very recent photo of a finger GBB greeting. Visual aids are always helpful in understanding the topic, do not you think?
In the end, I was about 75 pages of documentation I thought relevant. Of course, I had to include the letter GBB. Opposing counsel called everything irrelevant or privileged of course, but the judge allowed all this with a few lines written. Everyone's favorite was the literate bit produced by GBB.
As for the brother – the court decided that not only was very honest, due to the destruction of critical data in the case – his original team – but the relevant evidence and emails you taught to be apparently undamaged by the coffee. The case went to defeat, Debby and her firm were happy, and GBB became a legend.
About the Author
Steve Burgess is a freelance technology writer, a practicing computer forensics specialist as the principal of Burgess Forensics, and a contributorSteve Burgess is a freelance technology writer, a practicing computer forensics specialist as the principal of Burgess Forensics, and a contributor to recently released Scientific Evidence in Civil and Criminal Cases, 5th Edition by Moenssens, et al. Mr. Burgess may be reached at
http://www.burgessforensics.com
The Rise and Fall of a Radio Disk Jockey (Part 1 of 2)
Tags: disk jockey training, dj, jockey, radio, school, training