Computer Forensics - Why it Makes Sense

1. Computer Forensics - Why it Makes Sense Presented by: Craig Reinmuth CPA,CFF, MST, EnCE President, Expert Insights, P.C. Scottsdale, AZ (480)443-9064 www.expertinsights.net

2. Gammage & Burnham P.L.C.

3. Overview • Distinguish “E-discovery” from “Computer Forensics” • Using CF in every stage of litigation process • Benefits of Pursuing/Risks of Not Pursuing CF • How to Convince Your Clients to Use CF • Where to Look: Computer forensics is now “Digital” Forensics • Case examples throughout

4. ESI Build UP – Recent Landmark Cases • Zubulake – “Virtually all cases involve the discovery of electronic data”; attorneys to educate their clients on e-discovery • Qualcomm – Attorneys also face sanctions; risked losing license/livelihood • Pension Committee of U of Montreal defining “negligence” for purposes of sanctions • 323 e-discovery decisions in 2010 (including every Federal District) * * Based on year-end study by Gibson Dunn

5. 93% of information is created on computer

6. Litigation Support Services E Discovery

8. Computer Forensics(Beyond E-Discovery) Programs – when run Operating system changes CD Burning Activity Internet Browsing History File signature/renaming Recover web-based email Social Networking data On-line chatting data All ESI (cell phones, PDA, etc) • Recover/analyze deleted files; search unallocated space • Uncover spoliation • Detect use of external devices/USB history logs • Recent files • Determine user intent/ Timeline analysis • Review “restore points” • Documents printed/when

9. Sample USB Report Arizona State Bar

10. Computer Forensics(Beyond E-Discovery) Programs – when run Operating system changes CD Burning Activity Internet Browsing History File signature/renaming Recover web-based email Social Networking data On-line chatting data All ESI (cell phones, PDA, etc) • Recover/analyze deleted files; search unallocated space • Uncover spoliation • Detect use of external devices/USB history logs • Recent files • Determine user intent/ Timeline analysis • Review “restore points” • Documents printed/when

11. Case Example – Without Digital Forensics • 7/14 (evening) Human Resource Department receives email from EE indicating he/she wants to meet with boss the next day • 7/15 Terminates employment

12. Timeline with Computer Forensics • 6/6 Warm fuzzies re: business r/ship (gmail) • 6/11 Go to social event together (gmail) • 6/15 Forwards resume to competitor (gmail) • 6/17 Competitor invites EE to meeting on 6/19 (gmail) • 6/19 EE attends meeting at competitor office (gmail) • 6/20 (Sat) Install 1TB Backup storage device (USB) • 6/20 Accesses company projects on server(recent) • 6/20 (eve) Accesses company projects on server(recent) • 6/20 (eve) Goes to Google documents account (cookie) • 6/21 Apple computer in EE possession (deleted email) • 6/22 Proprietary project files sent to competitor (gmail)

13. Timeline with Computer Forensics (continued) • 6/22-6/28 Employment negotiations (gmail) • 6/25 EE connects USB thumb drive in LT (USB) • 6/25 EE accesses server/files from home laptop (recent) • 7/8 EE connects card reader for first time (USB) • 7/8 Empties trash (recover deleted files) • 7/14 (evening): • EE connects same backup drive to laptop (USB) • EE accesses project files from server (recent) • Email indicating EE wants to meet with boss (gmail) • EE communicating with b/friend re: computer on BB (phone) • EE access web mail account; forwards “opportunities” file (internet activity) • 7/15 Terminates employment (from client)

14. Computer Forensics(Beyond E-Discovery) Programs – when run Operating system changes CD Burning Activity Internet Browsing History File signature/renaming Recover web-based email Social Networking data On-line chatting data All ESI (cell phones, PDA, etc) • Recover/analyze deleted files; search unallocated space • Uncover spoliation • Detect use of external devices/USB history logs • Recent files • Determine user intent/ Timeline analysis • Review “restore points” • Documents printed/when

15. Defense Side Computer Forensics • Is your client telling you “the whole truth” • Be Proactive • Up-front strategy • Information on your clients’ computer they did not put there • Assist with demands of opposition • Turn claims into counter claims • Working knowledge of case law • Rebuke opposing experts’ credentials/methodology/findings • Deposition line of questioning

16. Computer Forensics is nowDigital Forensics

17. Smartphones (Blackberry, Droid, iphone) On the Device Other items uncovered Remote access programs (e.g. Log Me In, VNC, Homepipe) Web based email – specific providers Where else to go to get info • Call logs • Text/Instant messaging • Pictures • SIM card information • Emails and attachments (e.g. Outlook) • Phone directories • Internet history • GPS tracking

18. Cellphones and Pictures

19. Smartphones (Blackberry, Droid, iphone) On the Device Other items uncovered Remote access programs (e.g. Log Me In, VNC, Homepipe) Web based email – specific providers Where else to go to get info • Call logs • Text/Instant messaging • Pictures • SIM card information • Emails and attachments (e.g. Outlook) • Phone directories • Internet history • GPS tracking

20. iphone GPS Tracking

21. GEO Logging – GPS tracking

22. Computer Forensics is nowDigital Forensics

23. Computer Forensics is nowDigital Forensics

24. Get Head Into the Clouds!

25. Cloud Computing

26. Cloud Computing Tools MegaUpload Yousendit Idiskme Carbonite ibackup My account Idrive Kineticd Datadepositbox Flipdrive…… • MyDropbox • Docs.google • Skydrive • 4shared • Box.net • Mozy • Streamload • Drop.io • Livedrive • sugarsync

27. HomePipe Remote Access

28. Social Networking Obtainable Data

29. Computer Forensics in Each Stage of Litigation Process Testimony Case Strategy Discovery Analysis • Data preservation • Identify Electronic Evidence Sources • Assist with Cost/ Benefit Discussions with Clients • Interrogatory assistance • Avoid Exposure to Sanctions • For defense, view what is/is not on computer • TRO • Attend Meet and Confer • Types of Electronic Evidence to Request • Secure Collection & Preservation • Detect use of Storage Devices/ Data Downloads • Motion to Compel • Opposing Expert – • Deposition/Rebuke • Findings • Attend meetings with Judge • Getting all data needed to represent client • Determine user intent • Restoration of • Deleted Files • Review all relevant ESI • Printing/burning activity • Internet activity • Spoliation of Evidence • Knowledge of case law • Defendable Reports • Understandable Testimony • Integrity of Data • Vulnerability Assessment • Opposing Expert Cross Examination • Prior Experience Reputation Arizona State Bar

30. How to Convince Your Clients to Use Computer ForensicsZubulake – “Virtually all cases involve the discovery of electronic data” • Getting the data needed to represent your properly represent clients • Enhance Chances for Winning • Avoid exposure to sanctions (at client and attorney level) • Case dismissal potential • Professional fees potentially paid • Potential for turning claims into counterclaims

31. Summary • ESI/E-discovery/Computer Forensics are here to stay • Benefits of pursuing can far outweigh risks of not • Should be considered in all types of litigation (including Defense) and at every stage • Consider all locations for computer/digital information • The technological world continues to evolve • Smartphones are mini-computers and data sometimes does not go any further than palm of the hand • Cloud computing is here to stay and will grow in size • Recall example presented and the types of information that can only be obtained via computer/digital forensics

32. Expert Insights Dependable Defensible