THE POWER TO PROVE 1 New Advances in Spoliation Detection and Remediation David Cowen Rafael Gorgal

THE POWER TO PROVE 2 Introduction Who are we? Things We’ve written you might have seen –Hacking Exposed: Computer Forensics, currently working the third edition –Infosec Pro Guide to Computer Forensics –Anti Hacker Toolkit, Third edition –Hacking Exposed Computer Forensics Blog –This presentation

THE POWER TO PROVE 3 Spoliation Case law presenters involved with Super Future Equities Inc v. Wells Fargo Bank NA et al (Texas Case No. 3:06-cv ) Stille Sonesta v Tara Woodruff Buxton v David Cavin

THE POWER TO PROVE 4 Current state of spoliation detection Data destruction programs are noisy Most change timestamps to invalid dates (e.g. 1/1/1970) Deleted file records with invalid dates and random file names remain Counting the number of files remaining that match this criteria makes a base level total of spoliated files

THE POWER TO PROVE 5 Current defense arguments The files destroyed were personal The files destroyed were not relevant The files destroyed were part of a system process

THE POWER TO PROVE 6 New advances in spoliation detection Transaction Logging Decoded Change Logging added since Windows Vista

THE POWER TO PROVE 7 How the new artifacts are created XP – Transactional logging from interaction with the file system, may last 24 hours on a system drive Vista/7/8 – Change logging from interaction with the file system, may go back months

THE POWER TO PROVE 8 What can now be determined Ability to recover: –Pre wiped file name –Directory where wiped data existed –Metadata of file –Scope of total files wiped –Linkage to program execution –Determination of destruction time

THE POWER TO PROVE 9 What still cannot be determined Contents of the wiped files –Unless backups exist –Shadow Copies –Temp/Autorecovery files –Carved files

THE POWER TO PROVE 10 New arguments and defense presented Parties affected by spoliation can now show what was being destroyed, when and the context. Parties defending spoliation can now show that files wiped were in fact innocuous or non relevant

THE POWER TO PROVE 11 Impact of research on existing case law Ability to determine actual file names helps towards showing bad faith For some cases where the spoliating party was in fact telling the truth sanctions can be reduced or waived

THE POWER TO PROVE 12 Adverse Inference versus summary judgment Most common instruction we see is adverse inference to the judge or jury when determining the usage of the spoliated data. Now judge and juries can infer the content and usage of known files With the veil of mystery as to what was destroyed removed we may see more summary judgement

THE POWER TO PROVE 13 Role of an expert in a spoliation motion Prove what was done Determine if it was automatic or manual Validate the methods used to destroy Estimate the totality of the destruction Testify to the impact on the experts analysis Explain to the judge and jury what is determinable and what is recoverable

THE POWER TO PROVE 14 Standard of proof from prior cases Prove spoliation occurred Show that it occurred after notice or expectation of litigation Show scope of spoliation Show relevancy of spoliated data and how it prejudices the affected party

THE POWER TO PROVE 15 Questions? David Cowen Rafael Gorgal Blog - og.blogspot.com/