Ride The Lightning

CYBERSLEUTHING: SOME THINGS YOU CAN DO YOURSELF

Though I spend most of my time unearthing data from the bowels of computers, cell phones, PDAs, etc., folks often overlook obvious information that they can find for themselves. Two of the best experts in the country are my friends and fellow lecturers Carole Levitt and Mark Rosch. They publish a great book called The Cybersleuth's Guide to the Internet (more info at http://www.netforlawyers.com/prod01.htm). They have just started up a terrific print newsletter called "Internet Fact Finding for Lawyers" ($149/year). I particularly enjoyed reading about a court that expressed disbelief that a lawyer had failed to "Google" a missing defendant as part of due diligence. My, but times have changed! Subscription information may be found here: http://www.ali-aba.org/index.cfm?fuseaction=publications.publications_content&nojson=1&contenttype=IFFL#top. My favorite research from Mark and Carole, which is dog-eared from constant usage, is The Lawyer's Guide to Fact Finding on the Internet. This is one of the most useful books I have ever purchased, so I heartily recommend it if you spend a lot of time looking for things on the Net. In computer forensics, we spend a lot of time trolling for the sleeze buckets of the earth in places like MySpace and Facebook, but there are so many sources of information on the Net that it is really useful to have a compendium of sources to refer to. The brand new edition of this book may be purchased here: http://www.abanet.org/abastore/index.cfm?section=main&fm=Product.AddToCart&pid=5110568. If you don't want to buy anything, just check out http://www.netforlawyers.com and you'll find a lot of free resources as well.  A tip of the hat to Carole and Mark for such truly useful contributions to mining data from the Net!

E-mail: snelson@senseient.com   Phone: 703-359-0700

LUCK, BE A LADY TONIGHT: PROPRIETARY DATA ONLINE

I spent a wonderful weekend at Atlantic City celebrating my stepson’s 21st birthday. To drink and gamble at the same time struck him as a wonderful rite of passage – and Lady Luck even sent him home $700 richer. Atlantic City is a strange place, immediately attested to by a gentleman (perhaps that’s the wrong word) who was walking down the boardwalk wearing a rubber penis where his nose should have been. There are some things you shouldn’t even try to speculate about.

The bad news about my weekend was that I lost money (surprise). The good news is that I can still pay the mortgage. Further bad news: My expedition to the casino, where I should have been happily losing money to the Wheel of Fortune machine, was deferred by a client emergency. The really good news: Luck was indeed a lady and the immediate crisis was solved with astonishing speed.

Speaking generically to protect the client’s identity, the situation was not uncommon. Someone, perhaps an employee, had taken the company’s proprietary data and posted it on a message board. In general, message boards are pretty helpful at removing such data once they are advised that the proprietary data could only have been obtained by an employee breaching their confidentiality agreement. Indeed, this board was prompt in removing the offending post once it was notified of the situation via e-mail, and the crisis was over. The message board was put on notice that it should preserve all information regarding the post and the poster as the company intends to pursue its legal remedies.

This brings up a frequently asked question: How do you find the source of such data leaks? Hopefully, you are logging Internet usage for the employees. If so, then it is a fairly simple matter to review the recent logs for access to the message board URL. Depending on the logging level, a search for the poster's ID would be another approach. If the poster’s moniker is “geekster,” you look for that. You may need to look on local hard drives, which becomes complex if you have a large company and have no clue about the poster’s identity. Often, there is a group of key players so there can be targeted focus in the search. If you can come close to determining which machines may have been used for posting the proprietary data then a forensic technologist can analyze the Internet history of the hard drives to identify the exact computer and the user ID logged on at the time the posting was made.

Of course, it is always possible that the information was fed to a third party, and that there is no record on the company’s systems. In this case, companies frequently file a “John Doe” suit and then subpoena the message board, asking for all information available about the post (including the IP address it came from) and the identity of the poster (though not all message boards require genuine identifying information). The popularity of these “John Doe” suits is rising as companies seek to stem the tide of data leaks on message boards and blogs. So the crisis is over, the investigation begins, and I hope that Lady Luck, who deserted me at the casino, will stay with me through the investigation.

E-mail: snelson@senseient.com  Phone: 703-359-0700

“THE IPHONE IS EVIL:” FORENSIC EXAMINER’S LAMENT

Now that the hype of the iPhone’s debut is past, forensic examiners are looking at the iPhone – and not necessarily agreeing on what they are seeing. One of the most brilliant women I know is Amber Schroader (CEO of Paraben, http://www.paraben.com, one of the leading forensic software development companies). Amber flatly says “The iPhone is evil . . . it’s MAC OS X and it’s a completely closed system.” More optimistically, Derrick Donnelly, the chief technology officer of Blackbag Technologies (specializing in Apple forensics technologies, http://www.blackbagtech.com) points to the 4 or 8 GB storage capacity of the iPhone and says “there is more information in there than your average cell phone.” However, he also notes that he is struggling with a way to get the data off the iPhone closed system without altering the data by turning the phone on. Currently, the only solution is to turn the phone on and photograph screens, something that is ordinarily done only with the small minority of phones not yet supported by forensic software. Amber’s grim assessment gives me pause – if she can’t make the doggone thing talk, I doubt anyone can.

E-mail: snelson@senseient.com  Phone: 703-359-0700

ESI AUTHENTICATION: EASY TO SWALLOW SYNOPSIS OF LORRAINE V. MARKEL

You may recall from an earlier post that, worthy as the opinion in Lorraine v. Markel is, it put me to sleep (twice). At 101 pages, it is somewhat intimidating! However, it is a superlative guide to the authentication of ESI. If you can live without reading the whole opinion, but want an excellent summary, try this link: http://www.lexisnexis.com/applieddiscovery/LawLibrary/whitePapers/
ADI_WP_LorraineVMarkel.pdf

Many thanks to Courtney Barton of LexisNexis® Discovery Services for sending me this link. Courtney also points out that her company provides a number of excellent ED whitepapers which can be found at http://www.lexisnexis.com/applieddiscovery/lawLibrary/whitePapers.asp

Definitely a link to add to your Favorites!

E-mail: snelson@senseient.com  Phone: 703-359-0700

QUAKING IN THEIR ARMANI SUITS: LAWYERS WHO MISHANDLE ESI

August 29th is not shaping up as a good day for 14 lawyers involved in the Qualcomm Inc. v. Broadcom Corp. case. U.S. Magistrate Judge Barbara Major has ordered the 14 attorneys to show cause on August 29th why they should not be sanctioned for misconduct in their handling of electronic evidence in the patent infringment suit.  U.S. District Judge Rudi M. Brewster delivered a harsh assessment of the misconduct in his original August 6th opinion in the case. He found that Qualcomm's attorneys had removed e-mails from files before preparing employees for testimony and concluded that "Qualcomm counsel participated in an organized program of litigation misconduct and concealment throughout discovery, trial and post-trial before new counsel took over lead role in the case on April 27, 2007."  The court noted Qualcomm's production of over 200,000 pages of highly relevant e-mails and electronic documents four months post-trial. Ken Withers, a noted expert in federal procedure, calls the misconduct "in a class by itself" and concludes, "This seems to be a concerted effort to thwart the court's ability to find the truth." Ouch. Magistrate Judge's Major's August 29th hearing will give the attorneys a chance to explain their actions before sanctions are considered. Nine of the attorneys are from the Cupertino firm of Day, Casebeer, Madrid & Batchelder. The other five attorneys are from the Heller Ehrman law firm. As Ricky Ricardo would no doubt note to the lawyers, "You've got some 'splaining to do." Don't change that dial - I'll be back to report on the outcome.

The Show Cause order in the case may be found at http://www.klgates.com/files/upload/eDAT_Qualcomm_8_13_07_Show_Cause_Order.pdf

The original opinion may be found at http://www.klgates.com/files/upload/eDAT_Qualcomm_8_6_07_Order_on_Remedy.pdf

E-mail: snelson@senseient.com   Phone: 703-359-0700

SELF-INFLICTED WOUNDS: FAILURE TO AUTHENTICATE ESI (AND THE TRIUMPH OF SPIDERMAN 3)

By now, virtually everyone has heard about Lorraine v. Markel, the landmark case regarding the admissibility of electronic evidence decided in a Maryland federal court in May of 2007. It is a fearsome opinion, 101 pages in length. I read the digest of the case and printed it out with every intention of reading it. Ignored, though resting elegantly on my leather sofa, it glared at me balefully for weeks. Finally, knowing that I had a five hour plane ride to the ABA annual meeting in San Francisco, I packed the opinion to read on the plane. I started off well enough as the plane gained altitude, but with apologies to Judge Grimm, I have to confess that I fell sound asleep on Page 15. I know it was on that page because I awoke to find that page and my left hand covered with blue highlighter marks. I had been awakened by my husband, who wanted to let me know that the movies were coming on. Now I had a choice between watching Spiderman 3 or finishing the opinion. What can I say? Spidey won out. So much for my devotion to things intellectual.

Once the movie was over, I was well and truly without any further excuses from duty, so I buckled down and got through the whole opinion. Having been frequently asked by lawyers if they should really spend the time to read this opinion, my answer is a resounding yes. Judge Grimm does an exhaustive (or in my case, exhausting) job at examining all the issues regarding the authentication and admissibility of ESI. In a nice turn of phrase, Judge Grimm calls the failure to authenticate ESI a “self inflicted wound,” and one that judges see all the time. I have no doubt that some attorneys will be surprised by what they read – there are more means of authentication than you might imagine, whether we’re talking about chat room text, e-mails or website content. It is beyond the scope of a blog post to go through this opinion meaningfully, but rest assured, if you have questions regarding the authentication of ESI, this is the opinion to read. The decision may be found at http://www.mdd.uscourts.gov/Opinions152/Opinions/Lorraine%20v.%20Markel%20-%20ESIADMISSIBILITY%20OPINION.pdf

E-mail: snelson@senseient.com  Phone: 703-359-0700

YOUR CHEATING HEART: CAUGHT BY E-Z PASS

Some days you don’t have to go looking for a blog post. This was one of those mornings. Like the lemmings they are, newscasters this morning all seem to have glommed on to a facet of electronic evidence previously known mostly to divorce attorneys and their experts: the probative value of the E-Z pass. I woke up to this story on the Today show, heard it again on the radio on my way to work, and found it yet again in my Inbox courtesy of Virginia Lawyers Weekly.

If you use E-Z Pass or its equivalent on your way to or from your paramour, beware. E-Z Pass information is now regularly sought by divorce attorneys in those states where adultery may make a difference in how assets are divided. In child custody cases, it is often used to show how seldom a parent may be around while visiting their significant other, off drinking with buddies, gambling at the racetrack, etc. There are twelve states in the Northeast, South and Midwest that are part of the E-Z Pass system. Seven of those states will provide E-Z Pass information in response to court orders in both civil and criminal cases, including my own state of Virginia. Four more, including New Jersey and Pennsylvania, will provide such information only for criminal cases. West Virginia does not currently have a policy.

If a husband thought he’d save a little time getting that E-Z Pass and then used it to visit his honey, he may have sealed his fate in court. You can almost hear Carrie Underwood singing the words of a wronged woman in one of her most famous songs: “Maybe next time he’ll think before he cheats.”

E-mail: snelson@senseient.com   Phone: 703-359-0700

VISTA: HAPPINESS ON THE HORIZON OF COMPUTER FORENSICS

Ah, how we all worried about Microsoft’s VISTA operating system. While it was in development, the rumor was that Bitlocker encryption would permeate every version of VISTA. But lo and behold, it was reported that the Justice Department had a little talk with Microsoft (stressing how undesirable this would be from a law enforcement perspective) and that idea seemed to go away. As more than one IT company has had occasion to note, the DOJ can be most persuasive, perhaps most particularly when you are already in antitrust trouble.  Fortunately for law enforcement and computer forensics technologists, Bitlocker encryption is only available in the highest levels of VISTA (Ultimate and Enterprise), so it will present a far lesser problem than the computer forensic industry originally feared.

The wonderful good news is a new feature called Transactional NTFS, or TxF in bithead jargon, which keeps far more detailed user records. For those who choked on both terms, this means that computer forensic technologists can now tell you not only when someone last accessed the data (the usual limitation today), but potentially all the dates on which they accessed data, going back for months. When is this useful? One prime example is in situations where someone has purloined proprietary data. Now you can show that this data was accessed over and over and again, indicating constant usage of the data. This will be a boon to employers chasing former employees who have hoisted the company’s data to start their own company or to bring/sell it to a competitor.

Then there’s the implementation of shadow copy for the hard drive that VISTA keeps and the new Instant Search technology. This is a huge candy store for those who do computer forensics.

For those who want to know more, there is an excellent article on all this in the July issue of the ABA Journal. The article is entitled “A Lot of Room in Its View” by Jason Krause which may be found at http://www.abanet.org/journal/ereport/jy13tkjasn.html. Of course I have to tip my hat to the computer forensic technologist who was quoted in the article, Sensei’s own Vice President John Simek. I shall gravely consider whether a spot bonus is in order.

E-mail: snelson@senseient.com    Phone 703-359-0700

INQUIRING MINDS DEMAND THE SEX WITH ALIENS STORY

Within hours of my first blog posting, I was besieged with people begging for the Sex with Aliens story. I surrender to popular demand.

A very nice gentleman walked through our door last year and asked us very politely if we could please help him prove that his wife had sex with aliens who came through the family computer. Hearing this extraordinary request, one of our forensic technologists hurriedly decamped because he couldn’t keep a straight face. Another technologist managed to listen gravely and accepted the computer. Apparently, the gentleman’s wife had become pregnant and he had reason to know the baby was not his. She thereupon explained about the lusty aliens which had come through the computer and forced themselves upon her. He appeared to find this explanation plausible enough that he brought the computer in to see if we could substantiate his wife’s story.

This presented an ethical dilemma of sorts, which we finally resolved based on the gentleman’s description of his computer as “behaving strangely,” something that certainly could be caused by viruses, worms, spyware, and their brethren, though not likely aliens. We did indeed find a number of computer pests, all of the homegrown Earth variety, and scrubbed the machine. We thereupon presented the computer back to the client with the news that we had indeed cleaned his machines after finding viruses and spyware but were unable to find any trace of aliens. He accepted the news gracefully, and allowed as how aliens might be difficult to find. I imagine so. When and if I do find traces of aliens in computers, I promise you’ll hear it here first.

THE #1 FORENSIC SOFTWARE IS ENCASE – BUT IS IT BUGGY?

There is an ongoing dispute between the security consulting firm iSEC and forensic software vendor Guidance. Without doubt, EnCase is used more often than any other forensic software, but is it buggy? iSEC has published details of the problems, which include crashing or freezing when the software encounters corrupt data. We at Sensei are watching this with interest, as EnCase is our primary forensic application (like all vendors, we have an entire toolchest of applications).

Our initial take is that iSEC is likely correct. We have always let others bleed when a new version of EnCase is released, because it inevitably takes months, if not more than a year, for most of the bugs to be fixed. In fact, our guys laugh that when they can’t fix all the bugs, they release a brand new version of the software. They’ve already had a number of releases attempting to fix bugs in the current version of the software (they are now up to version 6.6 of EnCase's original 6.0 version). We are not yet even using version 6 in a production environment because we do not yet have full confidence in it. We too have experienced EnCase crashes, during both forensic analysis and acquisitions which might well be related to the problems identified by iSEC. Do these possible defects affect the reliability of the analysis? That seems to be the $60,000 question.   

If you’re interested in following the controversy, see the white paper at http://www.isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf

E-mail: snelson@senseient.com    Phone: 703-359-0700