The Pivotal Role Of Computer Forensics In Today’s Litigation

Electronically stored information (ESI) continues to take center stage in all types of litigation, from bankruptcy to tort. Author Keenen Milner discusses the critical role computer forensics experts play in collecting and preserving digital evidence.

Over the past decade or so, attorneys have come to realize that some of the most valuable evidence is found not in filing cabinets but on computers and servers. The 2006 amendments to the Federal Rules of Civil Procedure, which expressly made ESI subject to discovery, also reflect the growing role of digital data.

Read more here.

More Files Related to Jail Suit Scrubbed from Computer

Attorneys have discovered a second batch of missing computer files related to the inquiry into former Sheriff Bill Balkwill's award of a $9 million no-bid jail contract.

Someone deleted a "significant amount of data" from a desktop used by a top executive for Armor Correctional Health Services.

Read more here.

Computer Forensics Expert Warns Employers of Computer Fraud

Don't underestimate the wrath of a disgruntled ex-employee.

As the downturn forces businesses to shed jobs, employers should watch for computer sabotage by laid-off employees, says Gary Kessler, a computer forensics expert.

Just one vengeful act can cost a company thousands of dollars in repairs and lost productivity, and he said that these days it probably happens more often than many employers realize.

Read more here.

Boston DA Used Computer Forensics to Capture Suspected Craigslist Killer

A medical student facing charges of murdering a masseuse he had lured to a hotel through Craigslist was linked to the slaying in part by surveillance video and computer evidence, authorities said.

Philip Markoff, 22, was due in court in Boston on Tuesday in connection with the shooting death of a New York woman at a luxury hotel in Boston on April 14 and the kidnapping and armed robbery of another masseuse April 10 who was tied up at another hotel.

Read more here.

Questions Surround Former Sheriff's Laptop

Three months before 11,000 files were deleted from former Sheriff Bill Balkwill's laptop, the sheriff and two top administrators signed a document saying the computer had been sent off for recycling, according to court documents made public Friday.

In November, Balkwill, Maj. Tim Carney and Information Technology director Jeffrey Feathers each signed paperwork that indicated the laptop -- a key piece of evidence in a lawsuit over a lucrative jail contract -- was "obsolete," worth only $10 and had to be scrapped.

But the laptop was never sent to the recycling yard and Carney went to Balkwill's home to retrieve it on Feb. 4 -- the same day that someone used a common Internet program to erase 11,000 files.

The revelation that Balkwill's work laptop was supposed to be recycled came amid a criminal investigation at the Sheriff's Office, where detectives are trying to find out who deleted the files.

Read more here.

The Security Implications of a Computer Clock

Is the clock on every computer system in your organization set to the correct time? If your answer is no, you're not alone. According to a 2007 study by Florian Buchholz and Brett Tjaden, both professors at James Madison University in Virginia, more than a quarter of the Web servers on the Internet have their clocks off by more than 10 seconds. Making sure that computers are set with the correct time is one of those seemingly petty technical things that can unfortunately have big, negative consequences if not done properly. That's because assumptions about time and its flow permeate modern computer systems—including software, hardware and networking. This is true of desktop systems, servers, mobile devices and even embedded systems like HVAC, alarm systems and electronic doorknobs.

Buchholz and Tjaden studied Web servers because they are particularly amenable to analysis: Every time you request a page from a modern Web server, the server sends back an HTTP header called "date" which indicates the time-of-day for the server's clock. But unless your organization has made an effort to keep time in a precise and accurate way, the chances are very good that you're doing a bad job.

Read more here.

Houston Computer Forensics Expert Reinvents Career as "New Age" PI

A Houston computer forensics expert has changed his career in a surprising way. Gary Huestis is now a licensed private investigator for the state of the Texas.

Huestis, who is well-known in local computer IT circles, represents the new face of an old profession. “My new career path was literally born of the computer and Internet age,” said Huestis. “I am the last person in the world most people think would ever become a private investigator.”

The Private Security Board of the Texas Department of Public Safety recently licensed Huestis as a private investigator. He owns Houston-based EDiscovery Forensics, Inc. Since 1995, Huestis has also owned Houston Computing Services, a computer repair company.

Read the rest of the story here.

iPods Helping Criminal Investigations

Some months ago we reported on the use of iPods as an educational tool, and provided information on schools and universities that have incorporated this technology for the benefit of their students. Our report today involves a more complex use of iPods; iPods used by investigators to collect evidence and by defense attorneys. iPods' storage capability and functionality makes them a perfect device for defense attorneys and criminal investigators. They are inexpensive technology to record or format lengthy information. Maybe its creators did not envisage iPods for purposes other than entertainment but, as my grandmother said, a chair can help reach higher places.

In 2006, a U.S. District Court judge in Toledo, Ohio, approved the purchase of six iPods and power adaptor to be used by defendants in a multi-count drug conspiracy case. The goal was to provide the iPods to six defendants so they could listen to the FBI's wiretaps of their conversations before the case went to trial. Defendants were to listen to these wiretaps either at the U.S. Marshal's office -those detained- or at their defense attorney's office. Formatting the wiretaps into CDs cost the tax payers between $80,000 and $100,000 while the iPods and power adaptors cost less than $2,000 (about $330 per iPod). Content from 13 CDs were inexpensively downloaded in each iPod. One of the defense attorneys in that case said "the iPods are easy to use, save a lot of money, and control access to the information pursuant to the orders of the court. This is a promising solution to a real practical problem." Most of the defendants in this case were convicted; and, as for the iPods, it is not reported but our guess is that the court kept them; not the defendants.

Criminal investigators are also using iPods to record conversations; video-tape certain scenes; and take handy photographs; all these with an innocent-looking device. iPods can store movies, encrypted files, contacts, calendar information, etc., and this data can be later downloaded in a PC. Forensic experts have revealed that iPods have some special features that allow certain content to be hidden so secret information is not noticeable. Experts from Kroll Ontrack, a computer forensic company, state that iPods can serve as external hard drive to a host computer so files can be transferred through programs such as Windows Explorer, instead of iTunes. Kroll Ontrack has conducted forensic examinations on iPods and recommends considering the following issues when an iPod forensic investigation is conducted,

Ohio Supreme Court to Hear Digital Public Records Case

The Ohio Supreme Court on Tuesday grappled with the realities of the computer age as it weighed the question of when a “deleted” public record becomes a “destroyed” public record.

At issue is a lawsuit by The Blade seeking to force the Seneca County commissioners to hire a forensic computer expert at county expense to recover deleted e-mails from an 18-month period, some of which the newspaper contends may contain illegal private communications related to the proposed razing of the county’s historic courthouse.

“We’re talking about a very finite amount of time here, and we’re talking about e-mails from two or three people to one another,” said Justice Maureen O’Connor. “It just doesn’t seem to me to be that overwhelmingly burdensome or such a huge task here for the county to not even attempt to comply.”

Fritz Byers, The Blade’s attorney, told the court that the newspaper made a request under the Ohio Public Records Law seeking all e-mails sent, received, or deleted for an 18-month period beginning Jan. 1, 2006. The county provided a “smattering” of e-mails initially, he said, but then, after the paper sued, the county produced 700-plus pages of additional e-mails.

He noted that the commissioners have admitted that some records were deleted.

“If the court doesn’t rule fully in our favor, then it will mean that any official will be able to legally cover his tracks and misdeeds by a simple click on the computer's delete button,” said John Robinson Block, The Blade’s co-publisher and editor-in-chief.

Computer Forensics Experts Use Personal GPS to Solve Crimes

Like millions of motorists, Eric Hanson used a Global Positioning System device in his Chevrolet TrailBlazer to find his way around. He probably did not expect that prosecutors would use it, too — to help convict him of killing four family members.

Prosecutors in suburban Chicago analyzed data from the Garmin G.P.S. device to pinpoint where Mr. Hanson had been on the morning after his parents were fatally shot and his sister and brother-in-law bludgeoned to death in 2005. He was convicted of the killings this year and sentenced to death.

Mr. Hanson’s trial was among recent criminal cases in which the authorities used such navigation devices to help establish a defendant’s whereabouts. Experts say such evidence will almost certainly become more common in court as the systems become more affordable and show up in more vehicles.

“There’s no real doubt,” said Alan Brill, a computer forensics expert in Minnesota who has worked with the Federal Bureau of Investigation and the Secret Service. “This follows every other technology that turns out to have information of forensic value. I think what we’re seeing is evolutionary.”

Do Computer Snoops Need PI Licenses?

By now, we all know how the Recording Industry Association of America nabs alleged file sharers, more than 20,000 lawsuits and counting: Hired snoops from MediaSentry -- aka SafeNet -- log onto Kazaa, Limewire or other file sharing programs, peer into open share folders, take screen shots, download a few files and obtain the offending IP addresses.

But in a few states – Michigan, Texas, Florida, New York, Massachusetts, Oregon and Arizona -- the RIAA's investigators have come under attack by state governments or RIAA defendants. Reason: they are not licensed private investigators in their respective states. Michigan recently told (.pdf) MediaSentry it needed a license to continue practicing.

But demanding a private investigator's license doesn't make such sense for computer forensic work, according to the American Bar Association. In a recent report, the country's largest legal lobbying group urges the states to jettison the idea of, or licensing requirement for computer forensic specialists, especially since most state licensing boards don't demand education in such work