Protect Your Data – A Case Study

One of the easiest ways identity thieves can carry out their crimes is through a computer hard drive. Today, these thieves are becoming more tech savvy with their criminal methods. They seek out the innocent on fraudulent web sites or via email, and they often claim to be IRS agents or members of a banking institution, trying to gather residential addresses, Social Security numbers and bank account information. Another method they take is to visit a computer recycling center to see if hard drives that are being recycled still contain data.

Recently, I needed a spare hard drive for the lab. Instead of purchasing a brand new one, I paid a visit to my local computer recycling center. I found five computers with their hard drives still intact waiting to be recycled. I pulled the hard drives from the computers and took them back to the lab to use as spare drives. Using my forensic software, I looked at the drives to see what, if any, data was still on them. Four of the five drives were wiped clean, meaning that the data was permanently erased from the drive. The other drive contained a wealth of information which could have been used maliciously. I found addresses, social security numbers, medical insurance information, and other information that would be helpful to an identity thief. I wrote a letter to the owner of the computer (with the address I found on the hard drive) and notified them of what could have happened if the hard drive had gotten into the wrong hands.

Contact us for more information about how to keep your digital data protected – info@precisioninvestigations.net.

The Dark Side of Computer Forensics

WARNING:  THIS BLOG POST CONTAINS SENSITIVE SUBJECT MATTTER

I came face to face with the dark side of computer forensics three years ago.  I was involved in a child custody case of a five-year-old girl.  The wife retained me to forensically examine the family computer to review her ex-husbands online activity.  The first thing I noticed when I started the forensic analysis was that the wife and her ex-husband both used the computer under one user profile.  This information will come into play later on in this story.

I explained to the wife that because all of the activity falls under one user, it would be very difficult (if not, impossible) to determine who was seated at the computer and was physically online.  The wife told me that this was not going to be difficult since she was very sick with cancer and was undergoing tests and treatments out of state for several weeks during the specific dates and times that I was to analyze.

As soon as I started reviewing the internet history I found several Google searches for “incest” and “father/daughter sex” websites.  I relayed this information to the wife along with the dates and times the searches were conducted, and she determined that this was when she was out of state for treatment.  After finding these searches, I then started looking at the images/videos contained on the hard drive.  It was when I conducted a search for deleted images/videos that I found an indecent picture of an underage girl.  Because the image was deleted and found in the unallocated area of the hard drive, the dates and times the picture was viewed were removed.

Our company policy relating to indecent images of underage children is to cease the examination and contact law enforcement whenever one picture/video is found during analysis.  With that being said, I immediately contacted law enforcement and turned the case over to them.  I stayed in contact with the wife and acted as a liaison between her and the law enforcement officers handling the case.

I was called to testify in State court a couple of months later.  The defense attorney turned his attention to the fact that even though there were indecent pictures of underage children on the hard drive, it was impossible to say for sure it came from his client.  I had to agree to that statement, as I was not able to conduct a thorough investigation due to the fact that I turned the data over to law enforcement early on in the forensic analysis.  At the time of my testimony, law enforcement was still analyzing the hard drive, so they were not able to provide further information on the origin or dates and times of the indecent images.

After two days of the hearing, the judge awarded unsupervised custody to both parents.  I remember talking with the wife and her family after the hearing and heard their fear  about what the ex-husband will do to his daughter when she is alone with him.  We tried desperately to get the law enforcement officers to expedite their investigation, but they had a backlog of cases that they deemed more important.

The last time I spoke to the wife (a couple of months ago), they were in the process of appealing the custody decision and the ex-husband still had joint custody of the daughter.

Informatics In The Courtroom

About a week ago an article was published talking about how the field of information science has become critical to the collection, delivery, and analysis of data.  Most lawyers need to be educated on how electronic documents compare to paper documents.  Some specific examples from the article were the misunderstanding of “create date” in a document’s meta data, causing a inaccurate analysis of how long a document has existed.  This can be a simple yet large mistake in the courtroom.  To solve this problem, there must be strong communication between lawyers and people in the informatics field; otherwise that smoking gun might not be present in the evidence, even though 99.9% of the documents were retrieved.

Although about 95% of data is now stored electronically, it can be deemed useless if not handled properly.  There are several mistakes and poor practice methods that lawyers can perform, all of which can be prevented with the right team of specialists.  Here at PCI, we pride ourselves on constant communication and proper methods to ensure data collection and preservation, as well as informing clients on the data.  We go the extra mile to not only just handling data properly, but to provide support on how to utilize the data.

For more information on our best practice methods or have any questions, contact us at info@precisioninvetigations.net

Cloud Computing and Data Privacy

Last year, Levi Beers and Chris de Diego become the first example of criminal spammers in cloud computing. FBI agents targeted the two and were successful in obtaining evidence from Google relating to the spammers, who stored all of their incriminating evidence on the Google Docs platform. This is also the first publicly acknowledged search warrant benefiting from a suspect’s reliance on cloud computing.

According to the 1986 Stored Communications Act, the government is allowed to access a customer’s data whenever there are “reasonable grounds” to believe the information would be relevant in a criminal investigation. If the spammers left the data strictly on their hard drives, the FBI would have to personally serve the warrants, seize and image their computers, and then leave the spammers with a copy of the warrant and an inventory of everything taken. However, when issuing a warrant for data stored in “the cloud” the government has no obligation to disclose the cloud search to the spammers, unless criminal charges are filed.

The files found through Google Docs were a spreadsheet that showed the spammers spammed 3,082,097 e-mail addresses in a single five-hour spree and another document that listed 8,000 Yahoo webmail accounts the spammers allegedly created to push out their spam.
Read the full article and an affidavit associated with this case here.

What are your thoughts on this topic? Do you feel you should be notified if your documents are being searched on the cloud?

Trouble with Vista or Win7?

This blog is perfect for all our Windows Vista and 7 users.  When something goes wrong in Windows, it can be extremely frustrating.  FixWin is a portable application that puts one-click repairs at your finger tips, almost like an “easy” button from Staples.

Rather than digging around in the registry or Google-ing a hopeful fix, try FixWin. It is lightweight, portable, and it can fix over fifty issues that can pop up in Windows Vista and Windows 7. Whether your right-click context menu is missing in action or Windows Media Player suddenly will not start, FixWin has a one click fix to help with dozens of issues.

FixWin is portable, freeware, and Windows only, get it HERE. Give us come feedback on the utility.  Do you have another application to help with Windows issues?  Leave your comments below.

Teen Sues Mother For Harrassment on Facebook

A 16-year-old Arkansas boy is taking his mother to court over accusations she broke into his Facebook account and wrote slanderous comments about him. His mother claims” she was just concerned about her boy’s behavior”. The son claims his mother hacked into his Facebook account, changed his password, and posted remarks about his personal life. The mother claimed the boy forgot to log off his Facebook account and she had a look around “because she became concerned about her son after reading his posts on Facebook”.

Read the full article here and here.

How Computer Forensics Solved the BTK Killer Case

For more than 30 years, the case of the BTK killer was one of the biggest unsolved mysteries in America. The BTK killer killed 10 people in and around Wichita, Kansas, between 1974 and 1991.

Dennis Rader first committed murder in January 1975 when he killed four members of a family. For the next 15 years, he killed six more victims, all females. During his murder spree, Rader taunted police by sending them bizarre notes. In the first note he sent, which was found stuck in a book in the Wichita Public Library, Rader admitted to killing the family and provided details that only the police knew. He also created a nickname for himself – BTK (Bind, Torture, Kill). Rader sent several notes to the police, either directly or through the media, and some notes contained poems, puzzles, and pictures.
The local police and FBI spent thousands of hours analyzing the notes, following up on leads, and interviewing suspects. However, they were never able to tie the murder to Dennis Rader.

In 2004, after more than 10 years of silence from Rader, he started sending communications to the police. One such communication turned out to be the break in the case. Rader sent police a document created in Microsoft Office on a floppy disk. The floppy disk was immediately handed over to computer forensic experts for analysis. The forensic experts used EnCase software to examine the floppy disk and found another Microsoft Word document that was deleted on the floppy disk. The forensic experts recovered the document and after analyzing the metadata (data about data) found that it had last been modified by someone named “Dennis” at Christ Lutheran Church. Forensic experts then searched the church’s website and found that Dennis Rader functioned as president of the church’s congregation council. After police and FBI personnel checked Rader’s background and examined DNA evidence, they were able to link him to the BTK murders.

Dennis Rader originally pleaded not guilty, but later confessed and provided police with hours of details surrounding the murders. Dennis Rader currently resides in Kansas’s El Dorado Correctional Facility. His earliest possible release date is February 26, 2180.

The Dangers of the Internet

A news story came out of the UK yesterday that members of the Child Exploitation and Online Protection Center are requesting that Facebook implement a “panic button”. The button will serve as a direct email link to law enforcement where children can report cyber-bullying, sexual abuse, or any other threat or suspicious activity. The news story goes on to describe a case where an adult male created a Facebook profile portraying himself as a teenage male. After connecting with people, he developed an online relationship with a 17 year- old girl. The pair exchanged cell phone numbers and agreed to meet on a date, where the man raped and murdered the girl before dumping her body in a field. Read the full article here.

We worked a case where the daughter of a wealthy businessman went missing. The child was gone for two days when the parents contacted a private investigator (they didn’t contact law enforcement because of the possible exposure to the family). We were hired by the private investigator to perform a forensic examination on the child’s computer to try to determine what could have happened to her. After a thorough review of her computer, we found that through the social networking site Myspace.com, the daughter recently started exchanging emails with what appeared to be an older male. We were able to recover several emails that talked about setting a date and time to meet up and hang out. Shortly thereafter we found the email that gave details about the date and time they would meet up, as well as the name of the hotel where they were staying. We provided this information to the private investigator, who successfully brought the daughter back to her parents unharmed. In this case, the daughter willingly ran away from home to spend time with this older male.

The internet can be our best friend, but it can also be our worst enemy. With the increase in social networking sites, chat/video sites, and other sites tailored to the younger generation, the story above is becoming all too common. There are people out there joining these sites with the intent to develop relationships with naive teenagers in order to harm them physically or sexually.

We urge parents to keep a watchful eye on their child’s internet activity. The first step that can be taken is to make sure that the computer is located in an open room such as a kitchen, living room, dining room where parents can see what activity is occurring on a computer monitor. Another step for parents would be to set up parental controls on the computer and block websites that are not suitable for the child’s age. The one step we highly recommend is setting up an internet monitoring program on the child’s computer. Though this sounds like a sales pitch, Internet Monitoring is one of the services we provide. This service is both reactive and proactive. We can perform a mini forensic examination on the child’s computer to see recent internet activity, sent/received emails, chat participation, in, and recently viewed images/videos. Then we install and configure the monitoring software on the child’s computer which allows parents to see detailed updates of everything the child does on their computer. Though most parents feel it is betraying their kid’s trust, statistics and news articles don’t lie. It is better to be safe than sorry.

If you have any questions about internet safety and monitoring or want us to speak to your organization about this subject, contact us at info@precisioninvestigations.net.

Financial Divorce Forensics

Most of the divorce cases we get involved in revolve around finding evidence of an affair that a spouse had during the marriage. Lately, we have been getting involved in the financial areas of a divorce. Basically we gather all of the financial data found on the hard drive and produce that data to the attorneys or accountants we are working with. Examples of this data can be: financial software files (Quick Books, Quicken, Money, etc.), spreadsheets, and financial internet sites visited (banking sites, stock sites, etc.). This data can prove invaluable during a highly contested divorce. Often times, we have seen spouses attempt to hide assets from the other spouse.

We worked a case for the wife of a prominent doctor who was in the middle of a nasty divorce. The doctor had several practices plus three additional businesses he owned on the side. The wife claimed that she was owed more money than the doctor was willing to pay. We were called in to image the doctor’s computers, export out all of the financial data from them, and provide the data to a forensic accountant.

The attorney we were working with was a great guy, but this was the first time he was involved in a computer forensic case. We spent several meetings educating the attorney on our methodologies and capabilities. We also assisted him with drafting the legal documents in the case that pertained to computer forensics. We then had meetings with the forensic accountant hired to review the financial data in the case. Luckily, he had some experience with forensic investigations so getting him on board with our methodologies was a fairly smooth process.

Once we imaged the computers used by the doctor and his business associates we started recovering the data. Fortunately, we were provided access to the doctor’s personal accountant who helped us identify where most of the data was stored. We recovered several Quick Book files and backup Quick Book files, as well as hundreds of Excel spreadsheets detailing the finances for his medical practices. All of the data was neatly organized and in one central location. When it came to the doctor’s business ventures, the personal accountant’s memory became fuzzy. He claimed that the doctor and his associates kept terrible financial records and he had had a hard time from the beginning trying to organize and work with the financial data. In looking closer, we found that there were some relevant Quick Book and Excel files that were deleted. Once we recovered the deleted files we found evidence that the doctor was using the finances of one of the businesses as his own personal finances. From the money the business made, the doctor was chartering executive jets to Paris with friends, spending thousands of dollars on dinner with friends, and living a lavish lifestyle. This evidence was produced during the divorce case and the wife was given the additional money she was owed.

For more information on our methodologies and practice areas, email info@precisioninvestigations.net

Alert: BlackBerry Messenger Spam

For those of you who use BlackBerrys, there is a spam message going around.  Someone created a fake message pretending to be RIM (BlackBerry parent) alerting them about their server overload of BlackBerry Messenger users.  It says to forward it on to other users so RIM can see who is an active user vs. inactive user to free up space on their servers.  This message is FAKE!  Do NOT forward it on if you receive it.  Read more on CrackBerry here: http://bit.ly/d3KZ4a