FROM THE BENCH: EXPERT SHEDS LIGHT ON COMPUTER-GENERATED WILL
	THE BRILL FILES: KROLL ONTRACK'S MOST PECULIAR AND PUZZLING COMPUTER FORENSIC CASES OF THE YEAR
	KROLL ONTRACK NEWS & EVENTS

FROM THE BENCH: EXPERT SHEDS LIGHT ON COMPUTER-GENERATED WILL

In re Estate of Steed, 2004 WL 2912929 (Tex. Ct. App. Dec. 17, 2004). In a case involving a will contest, the sons of the deceased filed an application to probate a 2001 computer-generated will. The deceased’s widow filed a conflicting application to probate a 1998 holographic will. At trial, the jury determined the deceased never executed the computer-generated will and the deceased did not execute the holographic will with testamentary intent.

On cross-appeal, the sons argued the computer-generated will – found on the deceased’s computer after his death – was properly executed as a matter of law and the jury’s decision went against the great weight of the evidence. At trial, the widow’s expert had suggested someone could have easily manipulated the create date of the computer-generated will, making it unreliable.

The appellate court noted, however, that the widow’s expert was not a computer expert and had not actually examined the deceased’s computer. Moreover, the testimony from the widow’s expert conflicted with testimony given by the sons’ expert – who had actually examined the computer. The sons’ computer expert testified that any manipulation of the create date would have been easily detectable. The sons’ expert further testified he found no evidence of manipulation. Based on this and other testimony, the court reversed and remanded, stating the jury’s decision was “clearly wrong and unjust” and contradicted the great weight of the evidence.

THE BRILL FILES: KROLL ONTRACK'S MOST PECULIAR AND PUZZLING COMPUTER FORENSIC CASES OF THE YEAR

*** Written by Alan Brill, Senior Managing Director for Kroll Ontrack, The Brill Files reflects his work in the field with clients who have encountered some not-so-pleasant events and what was done to remedy the situation. With more than 25 years of consulting experience, Mr. Brill has assisted organizations with a wide range of technology security issues and is an internationally recognized speaker and instructor. ***

If you would like to explore the opportunity of Alan Brill speaking at a conference you are supporting or organizing, please contact Amanda Karls at (952) 516-3637 or at akarls@krollontrack.com.

Kroll Ontrack is the world leader in helping investigators, executives and attorneys obtain electronic data from individual hard drives and systems for use in a court of law or other investigation. From restoring hard drives burned to a crisp to detecting cyber scams, Kroll Ontrack computer forensic engineers have worked on some of the nation’s most high-profile computer investigations this past year. Even writers from popular crime investigation television shows call Kroll Ontrack when they are looking for technical information for episodes involving computer investigations.

The following Top 10 case examples maintain the confidentiality of Kroll Ontrack’s computer forensic clients, while offering some insight into how Kroll Ontrack’s computer forensic experts uncovered the “who, what, when, where, and why” of some of the most puzzling technology mysteries of 2004.

1) Hot Hard Drives: In an arson and murder investigation, a county prosecutor’s office asked Kroll Ontrack to analyze hard drives recovered from a burned house. The hard drives were charred and covered with ash and soot. When Kroll Ontrack engineers opened the drives in a sterile cleanroom – designed for repairing damaged computer media – they discovered the data contained on the individual data platters was not subjected to a high enough heat to cause permanent data loss. Relying on years of experience with fire-damaged computer media, Kroll Ontrack engineers recovered and produced all of the data to the prosecutor’s office for analysis. The evidence contained on the hard drives helped the prosecutors build their case against the charged individual.

2) Keystroke Calamity: Attempting to access passwords, account information, and other confidential data, an individual planted small “keystroke loggers” on the back of several computers at a large company. While investigating the situation, Kroll Ontrack engineers discovered these loggers. Kroll Ontrack detected the time and date when the logger was installed, allowing the company to retrieve its security videos and catch the corporate thief in the act.

3) Scamming Stopped: In an attempt to swindle an elderly couple, a man handed them a hard copy of a sales “contract,” alleged the couple created it on their computer, and then demanded they sell him a piece of property well below the fair market price. Kroll Ontrack engineers uncovered the scam, finding the couple’s computer did not even have Microsoft Word installed on their computer at all, making it impossible for them to have created the document on their computer.

4) Cracking Encrypted CDs: Working with one of the largest district attorney’s offices in the United States, Kroll Ontrack recovered more than 30,000 confidential files, stored on two CDs and written in a foreign language. The DA’s office came to Kroll Ontrack after another computer forensic company unsuccessfully attempted to open the files, surmising that the files were encrypted or compressed with some unknown piece of software or, alternatively, so corrupt they were unreadable. After completing an extensive analysis, Kroll Ontrack engineers determined the files were "GIF" (Graphics Interchange Format) files containing non-standard headers that prevented them from opening. Kroll Ontrack engineers repaired the non-standard headers, enabling the district attorney’s office to open and read all 30,000-plus files, looking for evidence specific to the matter at issue.

5) Pivotal Palm Pilot Passwords: A small financial services company sought to access calendar and email items contained on two former employees’ Palm Pilots. The company suspected the ex-employees had made several appointments, emails and phone calls with financial planning customers in attempt to steal the accounts shortly before leaving the company. The company’s IT employee could not access the Palm Pilot data due to password protection. Kroll Ontrack engineers, however, deciphered the system and file passwords on the PDAs, allowing a client to access calendar items, emails and phone logs not available in any other computer location.

6) Sinking Ships: After part of a large cargo ship sunk in international waters, a client called upon Kroll Ontrack engineers to recover and analyze the computer log files associated with the ship’s loading processes. The client asked Kroll Ontrack to focus on the metadata – specifically the “create” and “modified” dates – associated with the log files. Information resulting from the computer forensic investigation revealed the log files were altered after the ship sunk and one month before the computers were to be turned over for inspection.

7) Usurping USB Drives: On behalf of a bank, Kroll Ontrack engaged in a computer forensic investigation of several computers owned by a bank customer suspected in a money laundering scheme. The initial review of the computers revealed that a large capacity USB drive was installed on the machine one day prior to turning over the computers pursuant to the court order. Upon further review of the USB drive, Kroll Ontrack proved the individual had engaged in corporate financial fraud, heisted business funds, and stored the funds in foreign back accounts.

8) Email Evidence Exposed: A company suspected its chief financial officer was passing trade secrets and confidential information to one of the company’s biggest competitors. Kroll Ontrack engineers recovered emails confirming the CFO’s illicit acts, even though the CFO’s email PST was deleted and the hard drive was defragmented shortly before our engineers were permitted to mirror image the machine.

9) Preservation Protocol: A company asked Kroll Ontrack to help it comply with a document preservation order in a large government investigation. The company, at risk for spoliating potentially relevant information, sought assistance creating mirror images of several thousand hard drives scheduled to be erased and re-deployed within the company. To date, Kroll Ontrack has imaged more than 2,100 hard drives for the company, totaling more than 84,000 gigabytes of data.

And finally …

10) Diary Discrimination Debacle: In a discrimination suit, a former employee used electronic notes about the discrimination – created in an email system diary – to support his claims. The employee then claimed his computer crashed, making it impossible to examine an electronic copy of the notes. Kroll Ontrack engineers determined the diary feature was not available on the email system during the time the employee claimed to have created the notes, making the employee’s claim out of the question.

KROLL ONTRACK NEWS & EVENTS

Kroll Ontrack Launches New, Free Case Law Research Database

In December, Kroll Ontrack launched a comprehensive, Web-based case law database, allowing users to find relevant e-discovery and computer forensics cases quickly and easily. The free, easy-to-use database allows users to research by topic and jurisdiction to find case law pertinent to their most pressing legal technology issues. The database also allows users to pinpoint a specific case or selected term using its search-by-keyword function. Updated monthly, the database includes summaries of the latest e-discovery and computer forensics decisions on a variety of topics, including preservation and spoliation, production, sanctions, experts, and admissibility. Kroll Ontrack’s complete collection of case summaries are also available – by topic or by jurisdiction – in a single PDF document. In addition to the case law database, Kroll Ontrack maintains a listing of other relevant resources, including rules, statutes and secondary source materials relating to legal technology. The case law database is available at http://www.krollontrack.com/legalresources/caselawlist.asp.

Meet Kroll Ontrack Representatives at the Following Events: (For a complete listing of sponsored and speaking events, please visit http://www.krollontrack.com/upcomingevents/.)

Visit http://www.krollontrack.com/upcomingevents/ for more information on these events and others.

KROLL ONTRACK REQUESTS YOUR INPUT

Our legal consultants, project managers, and technology experts strive to stay on top of e-discovery law. If you are aware of any additional local court rules or new cases in this area of the law, please contact us by writing to mlange@krollontrack.com.

This newsletter is written by Michele C.S. Lange, staff attorney with Kroll Ontrack, with assistance from Charity J. Delich, a Kroll Ontrack law clerk. Ms. Lange has published numerous articles and speaks regularly on the topics of electronic discovery, computer forensics, and technology’s role in the law. She can be contacted by writing to mlange@krollontrack.com.

For more information about electronic discovery and computer forensics services, contact Kroll Ontrack at 1-800-347-6105 or http://www.krollontrack.com/.