Computer Forensics Docket Sheet

In a case involving a will contest, the sons of the deceased filed an application to probate a 2001 computer-generated will. The deceased's widow filed a conflicting application to probate a 1998 holographic will. At trial, the jury determined the deceased never executed the computer-generated will and the deceased did not execute the holographic will with testamentary intent. On cross-appeal, the sons argued the computer-generated will ' found on the deceased's computer after his death ' was properly executed as a matter of law and the jury's decision went against the great weight of the evidence. At trial, the widow's expert had suggested someone could have easily manipulated the create date of the computer-generated will, making it unreliable. The appellate court noted, however, that the widow's expert was not a computer expert and had not actually examined the deceased's computer. Moreover, the testimony from the widow's expert conflicted with testimony given by the sons' expert ' who had actually examined the computer. The sons' computer expert testified that any manipulation of the create date would have been easily detectable. The sons' expert further testified he found no evidence of manipulation. Based on this and other testimony, the court reversed and remanded, stating the jury's decision was “clearly wrong and unjust” and contradicted the great weight of the evidence. In re Estate of Steed, 2004 WL 2912929 (Tex. Ct. App. Dec. 17, 2004).

Alleging breach of various employment and confidentiality agreements and conspiracy to misappropriate trade secrets, the plaintiff filed a motion to preserve and protect evidence. The plaintiff claimed the defendant installed Incinerate, a software wiping utility, on his company laptop, deleted 94 megabytes of information, and returned the laptop without mentioning the deleted files. The plaintiff informed the court that it had made a backup copy of all of the documents on the laptop prior to the defendant's actions, and a comparison of the backup copy with the returned laptop revealed that the defendant had deleted documents relating to his involvement in the activities at issue. Based on the plaintiff's allegations, the court ordered all parties to preserve and “not erase, alter, modify, or destroy” any evidence, including e-mail and electronic documents. Hypro, LLC v. Reser, 2004 WL 2905321 (D. Minn. Dec. 10, 2004).

After discovering missing stock shares, an employer suspected embezzlement and requested the defendant's laptop computer for examination. The employer specifically told the defendant not to delete anything from the hard drive. A computer forensic analysis revealed the defendant attempted to overwrite files on the computer by running an “evidence eliminator” software-wiping program at least five times the night before he turned over the computer. The defendant was convicted of embezzlement and ordered to pay restitution, including reimbursing the employer for $1,038,477 of the total $1,268,022 costs spent on the forensic analysis. On appeal, the defendant argued the trial court should not have awarded the employer investigation costs, including the costs of the forensic examination. The appellate court rejected this argument and affirmed the district court's award, noting the defendant “purposefully covered his tracks as he concealed his numerous acts of wrongdoing from Cisco over a period of years. As the victim, Cisco cannot be faulted for making a concerted effort to pick up his trail and identify all the assets he took amid everything he worked on.” United States v. Gordon, 2004 WL 3015422 (9th Cir. Dec. 30, 2004).

Expert Sheds Light On Computer-Generated Will

In a case involving a will contest, the sons of the deceased filed an application to probate a 2001 computer-generated will. The deceased's widow filed a conflicting application to probate a 1998 holographic will. At trial, the jury determined the deceased never executed the computer-generated will and the deceased did not execute the holographic will with testamentary intent. On cross-appeal, the sons argued the computer-generated will ' found on the deceased's computer after his death ' was properly executed as a matter of law and the jury's decision went against the great weight of the evidence. At trial, the widow's expert had suggested someone could have easily manipulated the create date of the computer-generated will, making it unreliable. The appellate court noted, however, that the widow's expert was not a computer expert and had not actually examined the deceased's computer. Moreover, the testimony from the widow's expert conflicted with testimony given by the sons' expert ' who had actually examined the computer. The sons' computer expert testified that any manipulation of the create date would have been easily detectable. The sons' expert further testified he found no evidence of manipulation. Based on this and other testimony, the court reversed and remanded, stating the jury's decision was “clearly wrong and unjust” and contradicted the great weight of the evidence. In re Estate of Steed, 2004 WL 2912929 (Tex. Ct. App. Dec. 17, 2004).

Alleging breach of various employment and confidentiality agreements and conspiracy to misappropriate trade secrets, the plaintiff filed a motion to preserve and protect evidence. The plaintiff claimed the defendant installed Incinerate, a software wiping utility, on his company laptop, deleted 94 megabytes of information, and returned the laptop without mentioning the deleted files. The plaintiff informed the court that it had made a backup copy of all of the documents on the laptop prior to the defendant's actions, and a comparison of the backup copy with the returned laptop revealed that the defendant had deleted documents relating to his involvement in the activities at issue. Based on the plaintiff's allegations, the court ordered all parties to preserve and “not erase, alter, modify, or destroy” any evidence, including e-mail and electronic documents. Hypro, LLC v. Reser, 2004 WL 2905321 (D. Minn. Dec. 10, 2004).

After discovering missing stock shares, an employer suspected embezzlement and requested the defendant's laptop computer for examination. The employer specifically told the defendant not to delete anything from the hard drive. A computer forensic analysis revealed the defendant attempted to overwrite files on the computer by running an “evidence eliminator” software-wiping program at least five times the night before he turned over the computer. The defendant was convicted of embezzlement and ordered to pay restitution, including reimbursing the employer for $1,038,477 of the total $1,268,022 costs spent on the forensic analysis. On appeal, the defendant argued the trial court should not have awarded the employer investigation costs, including the costs of the forensic examination. The appellate court rejected this argument and affirmed the district court's award, noting the defendant “purposefully covered his tracks as he concealed his numerous acts of wrongdoing from Cisco over a period of years. As the victim, Cisco cannot be faulted for making a concerted effort to pick up his trail and identify all the assets he took amid everything he worked on.” United States v. Gordon, 2004 WL 3015422 (9th Cir. Dec. 30, 2004).