Ride The Lightning

MAC NABS CROOKS WITH BACK TO MY MAC AND PHOTOBOOTH

A new twist on electronic evidence: Earlier this month, the New York Times reported that a stolen Macintosh computer helped solve a burglary of a New York City apartment. The thieves stole many items, including TVs, iPods and DVDs, along with a laptop belonging to Kait Duplaga, an Apple store employee. The police were having trouble coming up with leads when Duplaga got a message from a friend saying that she was showing up as being online. She turned on the Back to My Mac feature installed on her Mac from another Mac. From there, Duplaga could operate her computer remotely, so she used a standard Apple program called PhotoBooth to snap a picture of a gentleman who was using her computer. The computer shows a “click down” when a photo is being snapped, which the perpetrator figured out, but he raised his hands to cover the lens too late. He was recognized as a guest who had been at a party at the apartment some weeks before. The photo led the police to arrest two suspects and recover almost all of the stolen property.

Smile, you’re on Candid Camera.

The full story may be found at http://www.nytimes.com/2008/05/10/nyregion/10laptop.html?_r=1&ref=technology&pagewanted=print&oref=slogin

E-mail:snelson@senseient.com    Phone: 703-379-0700

SENDING EDD DOCUMENTS ABROAD FOR REVIEW? HAVE YOU WAIVED FOURTH AMENDMENT PROTECTION?

K&L Gates had a really fascinating post today about a new federal lawsuit in which the law firm of Newman McIntosh & Hennessey, LLP of Bethesda, Maryland, is seeking declaratory and injunctive relief in order to gain certainty about whether the electronic transmission of data from the United States to a foreign legal services provider waives Fourth Amendment protection with respect to the data that is electronically transmitted.

This issue has long been a thorn, frequently debated by experts. You lower costs by foreign review but at what risk? The fact pattern is pretty interesting since the Indian litigation support company  (Acumen India) has not only solicited Newman McIntosh but might have data from competing or opposing law firms.

The case is pending in the United States District Court for the District of Columbia, and is assigned to District Judge Colleen Kollar-Kotelly, who also is the presiding judge of the Foreign Intelligence Surveillance Court.

As a cynic’s cynic, I was particularly amused by the request for a declaration as to whether “President Bush has an obligation to establish intelligence gathering protocols for the purpose of safeguarding Fourth Amendment rights with respect to attorney communications to and from foreign nationals residing overseas.” Wrong President to ask this of – try again next year guys.

The full K&L posting may be found at http://tinyurl.com/5sjaus

E-mail: snelson@senseient.com     Phone: 703-359-0700

HOW TO LOOK LIKE A MORON: METADATA MAKES IT EASY

Rick Segal, a venture capitalist and author of The Post Money Value blog, recently posted a hilarious metadata misadventure. Upon receiving a 115 page business plan, he checked the metadata and found that the plan’s author had failed to strip the metadata, leaving Rick free to read choice nuggets from the author’s advisors (which were supposed to hit the cutting room floor). Examples:

“Segal used work for Microsoft so skip the name dropping, save it for the afternoon meeting, they are clueless about Redmond.”

"When you talk through this point on your slides, make Chanukah jokes, he is Jewish and will get them."

"I'd delete this section since we don't have these features on the roadmap and haven't figured out how to code this unless you believe the investors won't catch this."

Scratched out "Exchange sucks resources like a vampire in heat", replaced with "Exchange is resource intensive under certain scenarios"

Actually I rather liked the “vampire in heat” image. Conjures up all sorts of salacious Anne Rice scenes. I hope folks will continue to fail to strip metadata – just for the entertainment value.

Rick’s post may be found at http://ricksegal.typepad.com/pmv/2008/05/the-coolest-bus.html

E-mail: snelson@senseient.com      Phone: 703-359-0700

JUDGES GO TO ED SCHOOL

Last week, John and I taught classes for the Judicial Conference of Virginia. So what are the judges thinking about with respect to electronic discovery? It is always interesting to hear from judges – their perspective is much different than the lawyers. Noted from the members of the bench:

1) Skepticism about the projected costs of ED, especially when used to bolster an “undue burden” argument.

2) Confusion about the meaning of “inaccessible” and how quickly this definition is changing.

3) Confusion about janitorial functions, defragging, compacting, etc. and how these functions should be handled when a litigation hold is in force.

4) A desire to learn how to quell the combat of samurai attorneys who insist on bringing every ED dispute into court.

5) Recognition that the federal rules will seep into the states in one form or another. We're still waiting in Virginia to see what form our rules will take.

6) Fascination with how other judges are handling ED issues, and a desire for that guidance from their more tech savvy colleagues.

7) Surprise at how much some computer forensics experts “puff” their CVs and a desire to learn about computer forensics certifications.

8) Shock at how easy it is to alter or fabricate evidence – we did an hour on this and they were absolutely amazed at the rapid-fire transformation of digital, audio and video evidence. They were even more shocked at how much of what we showed them had been done by our 15-year-old intern.

And my favorite tongue-in-check quotes –

“Isn’t there some ‘Idiot’s Guide to ESI’ I can read?”

“Do you guys pass out Advil when you teach this stuff?”

“Why am I here when I could be on the golf course?”

At least they went straight from our classes to the cocktail reception, so relief was at hand! Judge Rosemarie Annunziata, a good friend, was at the reception. She greeted us with a twinkle in her eye and noted unapologetically, “I love you guys, but I went shopping instead.” Good choice kid.

E-mail: snelson@senseient.com      Phone: 703-359-0700

“MY BAD” – ACCESSDATA GIVES ME A CALL

The blogosphere is an amazing place. Very shortly after I published my negative review of FTK 2, I received a phone call from Brian Karney, the COO of AccessData. To give credit where credit is certainly due, Brian offered a string of apologies, essentially saying “my bad” on behalf of his company. He could have been confrontational and argumentative, but he was genuinely acknowledging a series of errors (so many that I am still dumbfounded) and trying to convey the company’s sense that it needed to do a lot of damage control. Which it does.

For the moment, I am simply saluting the candor of the call and offering additional information from Brian’s follow up note to me, which said in part, “I agree we could have done a much better job of explaining and preparing our loyal customers for FTK 2 and the future of FTK 1.  As you can imagine we are doing what we can to clear the air on that matter now. We are confident that we are headed in the right direction addressing many of the core issues with FTK 2 and committed to not stopping until we do.” 

Brian also sent me a list of the items that are being addressed in the upcoming FTK v2.04 and FTK v1.80 release. 

Coming soon Version 2.0.4:
• 64-bit support
• Vista support
• Enhanced pre-processing performance
• Additional UI enhancements
o Much faster Quickpicks
o Much faster display of lists         
               
Coming soon — Version 1.8:
• RSR functionality (automated generation of registry reports)
• Microsoft Office 2007 support (recognition, indexing and display)
• New containers in the Email tab (webmail and other email)
• Bookmarking e-mail attachments with parent e-mail support
• Recursive file export (from the file, back to the root of the drive)

Though I am still slightly confused about Versions 1 and 2 of FTK, our friend Craig Ball tells me that he has spoken to AccessData's CEO, Tim Leehealey. Apparently, Mr. Leehealey acknowledged that the company had goofed in even naming the product FTK 2.0. He told Craig that, despite his company's marketing, they are two entirely different products geared to different customers. 2.0 is designed only for massively parallel, collaborative workgroups with legions of powerful machines (large corporations and the federal government, for instance). I’m not sure how we were supposed to divine this from the marketing, but the clarification is useful. If AccessData can get this word out (and perhaps rename FTK 2), it will better serve its customers.

Finally, I tip my hat to Brian and Tim for listening, talking to Craig and I courteously and going back to the drawing board to figure out how to make things right for their customers. As the Japanese (especially MY Japanese guy) are fond of saying, “Don’t point fingers – fix the problem.” Here’s hoping they do.

E-mail: snelson@senseient.com    Phone: 703-359-0700

ACCESSDATA ANSWERS FTK 2 CRITICS - AND APOLOGIZES

The following e-mail appears to have been sent (without running a spellchecker!) to FTK’s registered users yesterday.

"Dear FTK 2 Customer:

The release of FTK 2 has created much more confusion than we had anticipated, so we would like to take a moment to once again clarify a very important point. FTK 2 is not meant to be a replacement for FTK 1 for all customers. While some customers will likely see FTK 2 as a superior solution and make the move, some will no doubt prefer the simplicity and minimal hardware requirements of version 1. It is for that reason that we are committed to not forcing our customers to choose between the two. Not only does every dongle of FTK 2 ship with a full working copy of FTK 1(both solutions can be utilized at the same time), but we are continuing to support and develop FTK 1.  A new version of FTK 1 will be releaed (sic) shortly with some powerful new features, and there will be additional new releases in the future.

We acknowledge there are challenges with FTK 2, such as slow processing, complex installation and GUI response issues. We are very well aware of these issues and diligently working on addressing them as quickly as possible.  Over time, as we learn to take greater advantage of the power that a database-driven approach provides, we believe the vast majority of the customer base will transition. However we are not now, nor do we plan to in the future, forcing custumers (sic) in one direction or the other. There are situations in which a database-driven solution is better and situations in which a memory-based solution is best. Therefore we are enabling you with both, and will allow you to decide when to use each.

We appreciate the continued feedback and support. We know we have not made it the easiest transition and for that we apologize. It is nobody’s fault but our own as the product manufacturer. So AccessData is committed to making FTK 2 easier to use and to providing continued customer support and educational resources for those who are interested in them . . ."

************************
The tone is nice and there is some candor here. However, the letter is a bit disingenuous in suggesting that users should have known that there were choices here. From the point of view of users, version 2 was simply advertised as an upgrade – not as a choice, with enumerated pros and cons. Also, it is clear that the release was premature as no one who really does computer forensics seems to believe that this is currently a viable product. Obviously, AccessData has been receiving a lot of heat. The company blew a whole lot of good will with this ill-advised move and has a long way to go to get it back.

E-mail: snelson@senseient.com     Phone: 703-359-0700

CRAIG BALL BEATS ME TO IT: THE DISASTER THAT IS FTK 2.0

Here I had gone to the trouble of asking my partner John to stop grousing about FTK 2.0 and actually write about it and then he smugly points out that he doesn’t need to – our colleague and friend Craig Ball has beaten him to the punch. John further points out what is so often true, that no one could say it so well and . . . scathingly . . . as Craig did.

John and the other forensics technologists at Sensei were great fans of FTK 1.7x (the version we use) – loved the upfront indexing and the speed of indexed searching with the integrated dtSearch function. Now we get a higher priced (and higher maintenance) version which won’t install cleanly, doesn’t work on Vista, and places all data from various cases in a single database. We thought that we had purchased maintenance that entitled us to free upgrades. Apparently, AccessData has redefined the definition of free. Sure you get FTK 2.0 itself for no additional charge, but be prepared to pony up $50 for the new (I’m not sure improved or special) dongle that is required for this new version. So what happened to the free upgrade? Even Guidance Software didn’t charge (unless you didn’t return the old ones) for the upgraded dongles.

We’ve tried to use FTK 2.0 on 4 of our smaller cases just to see how it works. Not well would be an understatement. The cases involved single drives of 40GB and 80GB in size. Only one of the four was able to index the evidence overnight and that was one of the 40GB drives. Forget about the 80GB drives. To make matters worse, you have to let the processing continue to completion since there is no option to stop and pickup where you left off. Be prepared to dedicate a computer to processing the electronic evidence for a very long, long time. Think in terms of Rip Van Winkle.

To continue the rant, AccessData must have redefined the word ‘save’ in addition to free. After processing the ONE 40GB drive for multiple hours during the night and saving the case, the case could not be reopened. So much for saving the case file. Geez, even Microsoft gets that right.

So what have we done to recover from our apparent participation in the FTK 2.0 beta test? We’ve moved our licenses back to the original dongle so we can run cases in version 1.71 on Windows 2000, Windows XP and Windows Vista analysis machines. It really pains us that AccessData had an excellent opportunity to grab a huge amount of market share from Guidance Software (which is working overtime to alienate the private sector) and totally blew it. We really wanted to love this product and now feel burned by a faulty product that was clearly prematurely released.

That’s the semi-short version – to get the full version of Craig’s wrath (as if you didn’t get enough here), just check out his review. If this were Broadway, this play would have had a one night run.

Craig’s review of FTK 2.0 may be found at http://commonscold.typepad.com/eddupdate/2008/05/ftk-20-product.html

E-mail: snelson@senseient.com      Phone:          703-359-0700      

WAKE UP AND SMELL THE COFFEE: REPORT FROM SEATTLE ON DISGRUNTLED EMPLOYEES

Miraculously, it is sunny in Seattle – and with luck, we can shortly remove the manacles which bind us to our keyboards and go enjoy the sunshine. John and I have just wrapped up speaking at the ALA annual conference here – the topic was “Disgruntled Employees in Law Firms: The Enemy Within.” Probably the most surprising thing to us was the sheer number of attendees that have experienced cases involving disgruntled employees and electronic evidence – nearly all of them, in fact. Equally astonishing were the range of cases, from sex/age/gender discrimination to theft of confidential data, destruction of data, hostile workplace, embezzlement and insider trading.

At the large firm level, it appeared that firms are increasingly trying to plan for these circumstances and guard against them, but finding that some policies meet with stiff resistance from employees and that partners – big surprise – often wish to be exempted from policies. This is particularly true for policies involving the use of USB devices, the installation of “rogue” software, encryption and Internet and e-mail policies.

One suggestion we made to keep employees from becoming incensed at their employers is having outside experts (whether HR, compliance, legal tech, etc.) come in and educate employees about the need for the change and explain that the experts recommended the change. At least this deflects some of the heat from management and permits employees to better understand the change and ask questions. The truth is, no one likes restrictions, but they are necessary to secure data and to insulate law firms from many kinds of liability.

For those who are letting the infantry run the regiment, it is indeed time to wake up and smell the coffee.

E-mail: snelson@senseient.com       Phone:          703-359-0700       

WILL BLACKBERRYS BITE EMPLOYERS?

The National Law Journal recently featured an article which asserted that employers should be wary of a predicted wave of suits claiming overtime pay is due, those suits supported by irrefutable electronic evidence of e-mailing and dealing with phone calls after hours. Though BlackBerrys took center stage in the article, clearly any smartphone might prove problematic.

Some employees are exempt from the overtime requirements, but virtually all businesses have some non-exempt employees who may have a good case for making overtime demands. In order to stave off such suits, lawyers are recommending that businesses adopt clear smartphone usage policies (in addition to the computer polices they should have already) and obtain employee sign-off on those policies.

Reportedly, some law firms are already trolling for clients to lead the charge in this area. In response to the buzz in the press, businesses are beginning to make the decision to issue smartphones only to exempt employees. In a world where these devices have begun to be dispensed as routinely as Pez, it was probably inevitable that these devices would bring legal headaches. Time for another policy review.

E-mail: snelson@senseient.com    Phone: 703-359-0700

COFEE CAUSING JITTERS

Yes, I spelled it right! In case you haven’t heard, the computer forensics world has been buzzing about a free tool provided by Microsoft to members of the law enforcement community. COFEE (Computer Online Forensic Evidence Extractor) is basically a thumb drive which contains 150 commands and can be further customized. Distribution began last June and more than 2000 officers in 15 countries are now utilizing COFEE. Essentially, COFEE allows investigators to scan for evidence, decrypt passwords, analyze Internet activity, etc. on a “live” computer in a “read-only” mode and extract evidence for use in court.

Why the jitters? Privacy advocates worry that COFEE will find its way outside of law enforcement and be used as a snooping device. And of course, there is concern that law enforcement might misuse the device. A private equivalent of COFEE is sure to come, if indeed it doesn’t currently exist.

For all the hype, COFEE really doesn’t contain any new tools – the key to its notoriety is simply that it is a portable device that can be used onsite, often making it unnecessary to seize computers, and very quickly allowing the extraction of evidence.

Further information may be found at http://seattletimes.nwsource.com/html/microsoft/2004379751_msftlaw29.html

E-mail: snelson@senseient.com      Phone: 703-359-0700