Keep Your Secrets to Yourself Arizona State Bar November 4, 2010 Presented by: Craig Reinmuth CPA,CFF, MST, EnCE

Places ESI is Stored

Other Places ESI is Stored November 4, 2010 Arizona State Bar

Other Places ESI is Stored November 4, 2010Arizona State Bar

Other Places ESI is Stored November 4, 2010Arizona State Bar

November 4, 2010

Case Example 6/6 Warm fuzzies re: business r/ship (gmail) 6/6 Warm fuzzies re: business r/ship (gmail) 6/11 Go to social event together (gmail) 6/11 Go to social event together (gmail) 6/15 Forwards resume to competitor (gmail) 6/15 Forwards resume to competitor (gmail) 6/17 Competitor invites EE to meeting on 6/19 (gmail) 6/17 Competitor invites EE to meeting on 6/19 (gmail) 6/19 EE attends meeting at competitor office (gmail) 6/19 EE attends meeting at competitor office (gmail) 6/20 (Sat) Install 1TB Backup storage device (USB) 6/20 (Sat) Install 1TB Backup storage device (USB) 6/20 Accesses company projects on server(recent) 6/20 Accesses company projects on server(recent) 6/20 (eve) Accesses company projects on server(recent) 6/20 (eve) Accesses company projects on server(recent) 6/20 (eve) Goes to Google documents account (cookie) 6/20 (eve) Goes to Google documents account (cookie) 6/21 Apple computer in EE possession (deleted ) 6/21 Apple computer in EE possession (deleted ) 6/22 Project files sent to competitor (gmail) 6/22 Project files sent to competitor (gmail)

Case Example (continued) 6/22-6/28 Employment negotiations (gmail) 6/22-6/28 Employment negotiations (gmail) 6/25 EE connects USB thumb drive in LT (USB) 6/25 EE connects USB thumb drive in LT (USB) 6/25 EE accesses server/files from home laptop (recent) 6/25 EE accesses server/files from home laptop (recent) 7/8 EE connects card reader for first time (USB) 7/8 EE connects card reader for first time (USB) 7/8Empties trash (recover deleted files) 7/8Empties trash (recover deleted files) 7/14 (evening): 7/14 (evening): – EE connects same backup drive to laptop (USB) – EE accesses project files from server (recent) – indicating EE wants to meet with boss (gmail) – EE communicating with b/friend re: computer on BB (phone) – EE access web mail account; forwards “opportunities” file (internet activity) 7/15 Terminates employment (from client) 7/15 Terminates employment (from client) 8

Litigation Support Services E Discovery November 4, 2010Arizona State Bar Legal hold, collection and preservation Preserve in place Collect to preserve Preserve data integrity Provide metadata Processing Filter De-duplication Decompressing compound files Decryption Exclude known files Provide documents within timeframes, file types Provide documents containing certain search terms Indexing Hashing Delivering in a chosen review platform (e.g. Summation) Review Hosting/prepare for attorney review

Identification Preservation Collection Processing Review Analysis Production E-Discovery Smaller Cases Client/in-house Outside Professionals Outside Professional and Counsel

Identification Preservation Collection Processing Review Analysis Production E-Discovery Larger Cases Client/in-house Paralegals or outside Professionals Outside Professional and Counsel

Computer Forensics (Beyond E-Discovery) By Area of Litigation Bankruptcy IntellectualEmploymentGeneralPersonal Creditor's PropertyLabor LawCommercialInjuryInsuranceRightsCriminalSecurities Determine user intentXXXXXXXX Recover and analyze deleted files Uncover spoliationXXX XX Detect use of external devicesX X XXX Identify "recent" files accessedXXX X X Restore point analysisXXXXXXXX Registry analysis USB history logsXXX X XX What documents were printed/whenXXX X XX What programs were run/whenXXX X Operating system changesXXX X X CD burning activityXXX X XX Internet browsing historyXX X X File signature/renaming analysisX X XXXX Recover web-based XXXXXXXX Social networking data X XX X On-line chatting data X XX X TRO'sXXX XXXX Review of all ESI (cell phones/PDA's/XXXXXXXX photocopiers/cameras, etc.) Motion to Compel assistanceX X XXXX Participate in meet and confersXXXXXXXX Participate at hearings with JudgeXXXXXXXX Deposition/testimony servicesXXXXXXXX Preparation of defendable reportXXXXXXXX Working knowledge of case lawXXXXXXXX

Computer Forensics (Beyond E-Discovery) Determine user intent Determine user intent Timeline analysis/recent files Timeline analysis/recent files Recover/analyze deleted files; unallocated space Recover/analyze deleted files; unallocated space Uncover spoliation Uncover spoliation Detect use of external storage devices Detect use of external storage devices Review “restore points” Review “restore points” USB History logs USB History logs Documents printed/when Documents printed/when Programs – when run Programs – when run Operating system changes Operating system changes CD Burning Activity CD Burning Activity Internet Browsing History Internet Browsing History File signature/renaming File signature/renaming Recover web-based Recover web-based Social Networking data Social Networking data On-line chatting data On-line chatting data Assistance with “what to ask for” Assistance with “what to ask for” All ESI (cell phones, PDA, etc) All ESI (cell phones, PDA, etc)

Sample USB Report Arizona State BarNovember 4, 2010

Computer Forensics (Beyond E-Discovery) Determine user intent Determine user intent Timeline analysis/recent files Timeline analysis/recent files Recover/analyze deleted files; unallocated space Recover/analyze deleted files; unallocated space Uncover spoliation Uncover spoliation Detect use of external storage devices Detect use of external storage devices Review “restore points” Review “restore points” USB History logs USB History logs Documents printed/when Documents printed/when Programs – when run Programs – when run Operating system changes Operating system changes CD Burning Activity CD Burning Activity Internet Browsing History Internet Browsing History File signature/renaming File signature/renaming Recover web-based Recover web-based Social Networking data Social Networking data On-line chatting data On-line chatting data Assistance with “what to ask for” Assistance with “what to ask for” All ESI (cell phones, PDA, etc) All ESI (cell phones, PDA, etc)

Social Networking / Web Based Mail

On the Device On the Device Call logs Call logs Text/Instant messaging Text/Instant messaging Pictures Pictures SIM card information SIM card information s and attachments (e.g. Outlook) s and attachments (e.g. Outlook) Phone directories Phone directories Internet history Internet history Other items uncovered Other items uncovered Remote access programs (e.g. Log Me In, VNC, Homepipe) Remote access programs (e.g. Log Me In, VNC, Homepipe) Web based – specific providers Web based – specific providers Where else to go to get info Where else to go to get info Smartphones (Blackberry, Droid, iPhone)

How to Convince Your Clients to Use Computer Forensics Zubulake – “Virtually all cases involve the discovery of electronic data” Greater likelihood of getting the data you need to properly represent your clients Greater likelihood of getting the data you need to properly represent your clients Avoid exposure to sanctions (at client and attorney level) Avoid exposure to sanctions (at client and attorney level) Potential for expert fees to be paid for by other side Potential for expert fees to be paid for by other side Case dismissal Case dismissal Greatly Enhance Chances for Winning Greatly Enhance Chances for Winning Potential for turning claims into counter-claims Potential for turning claims into counter-claims

Defense Side Computer Forensics Is your client telling you “the whole truth” Is your client telling you “the whole truth” Be comfortable in Being Proactive Be comfortable in Being Proactive Assist with Up-front strategy Assist with Up-front strategy Assist with demands of opposition Assist with demands of opposition Turn claims into counter claims Turn claims into counter claims Working knowledge of case law Working knowledge of case law Rebuke opposing experts’ credentials/methodology/findings Rebuke opposing experts’ credentials/methodology/findings Deposition line of questioning Deposition line of questioning

Other Potential Needs for Computer Forensics Expert TRO – collection/review of electronic devices TRO – collection/review of electronic devices Review of other ESI Review of other ESI Motion to Compel Assistance Motion to Compel Assistance Motion for Spoliation Assistance, including testimony Motion for Spoliation Assistance, including testimony Participate in Meet and Confer Participate in Meet and Confer Participate in Meetings with Judge Participate in Meetings with Judge Deposition/testimony services Deposition/testimony services Preparation of defendable report Preparation of defendable report Working knowledge of Case Law Working knowledge of Case Law

Computer Forensics in Each Stage of Litigation Process Arizona State BarNovember 4, 2010 Defendable Reports Understandable Testimony Integrity of Data Vulnerability Assessment Opposing Expert Cross Examination Prior Experience Reputation Getting all data needed to represent client Determine user intent Restoration of Deleted Files Review all relevant ESI Printing/burning activity Internet activity Spoliation of Evidence Knowledge of case law Attend Meet and Confer Types of Electronic Evidence to Request Secure Collection & Preservation Detect use of Storage Devices/ Data Downloads Motion to Compel Opposing Expert – Deposition/Rebuke Findings Attend meetings with Judge Data preservation Identify Electronic Evidence Sources Assist with Cost/ Benefit Discussions with Clients Interrogatory assistance Avoid Exposure to Sanctions For defense, view what is/is not on computer TRO Case Strategy DiscoveryAnalysisTestimony

Summary Zubulake – “Virtually all cases involve the discovery of electronic data” Computer Forensics Can Help Your Clients Keep Their (Trade) Secrets to Themselves It is a Win/Win It is a Win/Win Goes Well Beyond E-Discovery Goes Well Beyond E-Discovery Determines User Intent; Provides “Timeline” of Activity Determines User Intent; Provides “Timeline” of Activity Considers all Potential Sources of ESI Considers all Potential Sources of ESI Can Greatly Enhance Your Chances for Success Can Greatly Enhance Your Chances for Success Avoid exposure to sanctions Avoid exposure to sanctions Should Be Considered by both Plaintiff and Defense Should Be Considered by both Plaintiff and Defense

Right, what’s a “Gigabyte” Document = 26,214 bytes Box of documents = 2,000 pages or 50 megabytes Truck of boxes = 1 million pages or 25 gigabytes