Lawyer Monthly Magazine - May 2019 Edition

MAY 2019 50 Expert Witness www. lawyer-monthly .com Data recovery can reveal more than you may want people to truly know. I mean, that is what the ‘empty from recycle bin’ button was invented for; we wanted to remove all traces of something which may come bite later on. However, speaking to Steve Burgess, President of Burgess Consulting and Forensics, we find out that often our (‘questionable’) browser history and secret documents may not truly be deleted, even if we clear cache and remove all traces. He says: “I was there from the start: I saw the data recovery industry in 1985 when Bobby Brown’s manager came begging to this former floppy drive repair company (yes, floppy drives!) to recover data from his crashed 10MB (yes, 10 MB) DOS hard disk. Developing methodologies for recovery, an industry was born.” From floppy disks to our smartphones, we speak to Steve about how even though technology is everchanging, its impact in legal cases remains. Why is computer forensics important to legal cases? Users generally don’t notice or realize that when we start a document and every time we reopen, revise, or print it, additional partial or complete copies may be automatically made. We also don’t generally realize that when a document or a file is deleted, it doesn’t just go away. In fact, very little happens to it. A deleted document may be recoverable even years later. That’s not just true for documents – with internet history, hundreds of thousands of web and network visits stick around for years after the history seems to have been deleted, even when we are using “incognito” or privacy modes. We rarely find fewer than a hundred thousand deleted history entries when we go looking for them. These very same web visits automatically download many files, often photographic images, into the computer’s cache, which similarly can stick around for years. How often do you think cases are impacted by false claims of ‘losing data/files’? Happens all the time. I don’t have a particular statistic on it, but a significant percentage of cases I take include recovering lost data – whether done purposely or accidentally. In many cases, the user doesn’t even know that such data existed. In others, there are outrageous actions that intentionally try to lose the data. In more than one case I’ve had, the user has actually thrown away the computer or the computer’s disk drive. In another, the user reformatted the computer with a different type of file structure, then wrote a boatload of data to it. We still found the incriminating data, however. In yet another case, I was scheduled to go to a site to forensically image a dozen computers. They needed to delay the time for my arrival by three days. Once I reviewed the data, I saw a log of the thousands of files they had been trying to shred in the three days that they had delayed letting me show up. Spoliation of data can be a big problem. Missing data can, of course, make it difficult to winnow out the truth. But the very fact of purposefully destroyed data can result in sanctions for the side spoiling the evidence. In more than one case, the discovery of an act of spoliation lost the case for the spoiler. From the above, what are signs that those claims are false? From a forensic perspective, a sign that the claims are false are when the data exists, as it often does. Pretty much all documents start on a computer. The making, editing, printing, and otherwise accessing these documents, leaves many unnoticed and invisible traces behind. Forensic techniques can bring those documents or artefacts to surface. Steve Burgess Burgess Consulting and Forensics ABOUT STEVE BURGESS I’m Steve Burgess, President of Burgess Consulting and Forensics. Personally, I’ve written and spoken widely and con- tributed the comprehensive Computer Forensics sec- tion to the text, “Scientific Evidence in Civil and Crimi- nal Cases (5th edition),” by Moenssens, et al. Many of our written and video arti- cles can be found in various legal journals as well as on the BurgessForensics web- site at http://burgessforen- sics.com/articles.php and on YouTube. I am deposed and quali- fied as an expert witness in State, municipal and military courts, and labor boards in California and Texas. COMPUTER FORENSICS FIRM PROFILE Steve’s company has per- formed data recovery, electronic data discovery and forensic analysis on more than 15,000 hard disks and other digital media for firms and individuals in 22 states and several coun- tries. One successful recovery for the World Security Council resulted in improved nego- tiations and breakthroughs in George H.W. Bush’s summits with Mikhail Gor- bachev. The company mentor stu- dents and entrepreneurs in Santa Barbara and San Luis Obispo Counties, for Californian Polytechnical Institute students, as well as for local high school teams. They also partici- pate in Startup Weekends in Santa Barbara and San Luis Obispo Counties – mentor- ing, coaching, and judging.