About Us »
Case Histories: Our Own "Rogues Gallery"
Please note: The facts in each of these examples are accurate, but certain liberty has been taken to disguise and protect the involved parties...on both sides.
WE DON'T KNOW WHAT HE'S DOING...
...BUT DATACHASERS KNOWS, AND SO DOES THE FBI.
After being terminated for cause, a high-level executive left behind two computers containing a total of six hard drives.
DataChasers® was called as defense preparation against a wrongful termination lawsuit. The investigation revealed that the employee was heavily involved in the distribution of pornography, including child-porn, and had established websites to that end.
Being made aware of the case, the FBI requested DataChasers' continued assistance in gathering additional evidence from the computers. Through DataChasers' efforts, a Federal Grand Jury indicted the employee, and a major child-pornography ring was defeated.
Needless to say, the company is not worried about any wrongful termination litigation!
HELP! We're in court on next Tuesday! (DataChasers® is good, but we can't make chicken salad out of chicken soup.)
Confronted with fifty hard drives, and seeing only dollar signs, a "newbie" computer examiner promised the attorneys that he could have the evidence analyzed by their crucial trial date...the following week. Called in to assist, DataChasers® examiners found a room in chaos; hard drives that had been acquired using several different methods (mostly by non-forensic means); make-shift equipment scattered everywhere, and an examiner who really needed Valium. The bottom line was that the examiner had made promises that were impossible to keep. DataChasers triaged the situation, determined vital goals, organized the equipment, added our own lab equipment, and set immediate critical task priorities. We were able to discover what data was possible to obtain in the time allowed, and presented the attorneys with substantial evidence to present at trial.
Three mistakes were made on this case.
- The examiner took shortcuts that compromised the integrity of the evidence, and attempted a job for which he was not qualified. In order to get the job, he told the attorneys what they wanted to hear.
- The attorneys were at 3rd & goal, but the clock had run out. They did not allow enough time to obtain what was needed.
- They chose an inexperienced examiner with no certifications, and relied on his non-existent expertise to give them good advice.
IP (Intellectual Property), THE BILLION DOLLAR LOSS POTENTIAL!
When Mr. "Smith" left Company-A, he ensured his value and success to Company-B by supplying IP secrets. Then DataChasers discovered the e-mail: "Attached are the customer lists and distribution schedules that I promised. When I come over I'll bring the the remainder of the country and the overseas ledgers as well."
Judgment for the plaintiff (DataChasers' client) was generous, punitive, and prevents both the ex-employee and Company-B from conducting business in the same industry as Company-A, forever!
THE SMOKING GUN!
A major movie studio discovered pirated movies being offered on the Internet. How do they know the movies were pirated? Because they had not yet been released on video or DVD!
A simple trace led studio investigators to a public agency's network (Eureka...deep pockets!), and their IT personnel followed the trail to a specific computer. Fortunately, the agency called DataChasers to do the forensic work on the computer, during which a plethora of additional material was discovered, including pornography. The employee's defense: "I didn't do it."
However, a computer examination revealed the employee's offering on the Internet, with his name and his statement, "Here's my IP address," which, coincidently, was assigned to the suspect computer! As for the pornography, it became difficult for him to explain how shortcuts to the objectionable material found their way to his desktop.
No more deep pockets!
HE SAID, SHE SAID...
She said: "He threatened to fire me unless I went out with him."
He said: "The relationship was consensual."
Threatened with a sexual harassment lawsuit, the employer hired an attorney, who retained DataChasers to see what the office computers had to say.
An examination of both computers revealed deleted and hidden data that proved she, not he, was really the aggressor. When confronted with the recovered data, both attorneys had but one thing to say: "Case closed."
EDUCATORS ON THE INTERNET
An all too familiar story:
The classroom is setup so that no one can approach the teacher from behind. Whenever the teacher is approached, he quickly closes his laptop. But one day he forgets, and leaves his position of security to answer a question, and a student sees pornography on the computer.
Realizing he's been caught, he deletes all inappropriate material, and then defrags the computer.
DataChasers® was asked to examine the computer quickly in order to provide a resolution to the situation. An examination provided the evidence needed to suspend the teacher without pay, pending police action.
The police eventually acquired their own evidence, and the teacher was charged criminally, but this process frequently takes up to two years before the evidence is substantiated by law enforcement.
THE CASE OF CORPORATE FRAUD
It doesn't take a rocket scientist to figure out that if you give an employee carte blanche for writing checks, they're likely to abuse it. That is exactly what happened to a major motion picture company in Southern California.
A well-paid executive's duties included purchasing specific product from a variety of vendors, with little accountability. The enterprising exec went into business with an accomplice purchasing numerous items, and spending into the high-six-figure-mark of the company's money. The only problem was that no product ever came into the company. (It doesn't seem to matter how much money a greedy person makes, they always seem to want more.)
When discovered, the company terminated the employee. But being a long-term and trusted executive, the company let the exec return to his office, just to clean things up. He cleaned things up well enough, including the computer-or so he thought.
To make matters worse, the company had their own internal I.T. people attempt to recover the data-without success.
Forensically examined, the computer yielded all the evidence needed to substantiate the termination and seek restitution or prosecution at the company's discretion.
Note: You may want to refer to the Maintaining Data Integrity and A Technician Is Not An Investigator links on this website for a complete overview of how to best preserve the existing data on a computer.
HELP! I'VE FALLEN AND I CAN'T GET UP!
"I gave my old computer to my daughter and she was supposed to transfer all the files to my new computer."
The client's daughter did her best, but she deleted a file in error, a very important file, an Excel file that documented a 6-figure business relationship with a prior partner. His daughter saw that it was a very old file and thought it to be inconsequential. Nothing could have been further from the truth.
The client was now involved in litigation with his previous partner, and that file proved his case.
We pulled the hard drive, put it in our forensic machine, and within a very short period of time the file was recovered, in its entirety. Needless to say, this is a very happy client.
WRONGFUL TERMINATION
("THEY FIRED ME WITHOUT CAUSE.")
A Southern California garment manufacturer produces several popular lines of clothing, and costumes for most of the motion picture industry. They terminated a high-level employee for incompetence. The employee had previously been fired from another company for the same reason, and then sued that company for wrongful termination, resulting in a 7-figure settlement to the employee.
A forensic computer examination of the machine used by the employee gleaned eight, 3-ring binders (over 3,000 pages) of evidence and established the terminated employee's activity while supposedly working (proven by hidden date files within the computer). This activity included his private e-mails, surfing the web, political activity, downloaded pornography, personal correspondence, and many other personal activities.
Needless to say, the investigation was expensive for the company, but it provided ample defense to a probable lawsuit.
MY SPOUSE SPENDS ALL HIS TIME ON THE COMPUTER. WHY?
What is he doing on the computer? Has he posted my picture on the Internet? Is he having an affair? Is he corresponding with other women? Is he into chat rooms? Has he manipulated our savings? Is he spending our money? What we do between ourselves is one thing, but what else is going on?
This supposedly simple computer examination was ultimately extended to the examination of three PCs and two laptop computers, as well as hundreds of floppy diskettes and CDs. From what we were told, the wife had good reason to be suspicious. All indications were that the husband was being deceptive. Was he? What was going on?
The result? Happily the result was nothing other than what the suspicious wife already knew about, which was extensive. But now she knows for sure. Was it worth the effort? Yes, the examination alleviated her suspicions and in all probability saved their marriage.
But does it always turn out that way? Read on for the rest of the story...
MY HUSBAND'S ALWAYS ON THE COMPUTER. WHY?
She came to us because she suspected her husband was deeply involved in pornography, which she could handle, but if he was having an affair she wanted to know.
A forensic preview of the computer was accomplished in the client's home. This is a base-level examination; however, information can frequently be recovered at this stage of the forensic examination-especially if specific data is known and requested. This level of examination takes only a few hours and can be very valuable in specific cases.
The result? Sadly the result was not comparable to the pervious case. Specific data was recovered, proving the client's worst fears. There was no doubt that the husband was having an affair with his associate. But now she knows for sure.