In both cases, the employees thought they had hidden their tracks by deleting their recent browsing history. But because a computer’s operating system maintains the URL addresses of the websites visited in separate files, and other operating system files record images of those sites, through the use of forensic tools, these disparate files were extracted, combined, displayed visually, and the story of their activity revealed. One ended with the employee being terminated, the other with the IT administrator haled into federal court after he surfaced at a competing firm.

While most forensic experts identify the information as the computer’s “Internet history” it is much more than just a compendium of web addresses. Because a number of Windows Explorer system files act in the same fashion as the Internet browser system files, when the “history” is extracted, information such as what files were viewed on a thumb drive or where the user went on the company server can often be determined. This user activity is betrayed by the formation of link files, which are created when a user inserts a USB device into the computer and opens a document from it or uses Windows Explorer to navigate to a location on the server. If an employee is suspected of stealing a customer list or other confidential or proprietary information, but the USB device is not available for inspection, the Internet history might seal his/her fate.

The history will also provide evidence of online document storage sites like Dropbox and Google Drive, and data backup sites such as Carbonite and Mozy. Whenever company file access activity on the employee’s computer matches that of visits to these categories of websites, it is best practice for counsel to issue preservation letters and/or subpoenas to prevent the information from becoming lost.

More sophisticated forensic software can also rebuild cached images of webpages and webmail messages just as the user saw them. Because webmail does not reside on the local hard drive, the only evidence that an employee was communicating with others about potentially unlawful activity or sending company documents to a personal email account might come from an examination of email fragments recovered from the Internet history.

Practice Point: The immediate preservation of a suspect computer should be the top priority for any in-house counsel, litigation counsel, Human Resources Professional or IT administrator. Electronic evidence is ephemeral and can be destroyed through the normal use of the computer. Permitting even the weekly updates by Microsoft to be installed can destroy essential evidence needed to prove a case. In short, to maximize the amount of available evidence in cases like those described above, the computer should be turned off and secured in a location where it cannot be accessed until a forensic bit-by-bit mirror image of its hard drive is created. If the subject of the investigation is suspected of downloading or actively running malware in an effort to harm the company (such as Cryptowall or other ransomware), the computer should be left running, but its power cord or battery removed (to keep its RAM intact for analysis).

In a case involving stolen computer files, the dates and times when those files were copied off a device, and the date and time they were copied onto another (or when they were last accessed or viewed) can mean the difference between inculpation and exculpation.

Consider these fact patterns:

1. “My client may have emailed those confidential documents to herself, but she saved them on her computer only because she was told she might need to work at home to get the project done. She never looked at them again.” Upon a forensic examination of the laptop, the “last accessed” dates for all the company documents she saved to her computer match the date she met with the attorney. Why? Because the attorney wanted to review them before responding to the prior employer’s demand notice/lawsuit. Counsel’s ability to credibly argue her client never looked at the files after she saved them years ago just got harder.

2. Same case, but instead of files on a laptop, the files are on a thumb drive. “My client may have copied them onto a thumb drive, but she swears she never copied them elsewhere.” Upon a forensic examination of the thumb drive, all the “last accessed” dates were changed to the date the client met with the attorney. Why? Because the attorney inserted the thumb drive into her computer and copied them to the server to review them before producing them to the other side. Counsel’s ability to credibly argue her client never copied them elsewhere just got harder.

3. Same case, but instead of saving files to a personal laptop, the client deleted her personal files from the company laptop. “My client only deleted her pictures and personal documents prior to returning the company-issued laptop to HR.” Upon a forensic examination of the laptop, it is determined that on three separate days leading up to the employee’s departure, a file wiping program was used to permanently destroy a host of files—all that was left was a pattern of 1’s and 0’s over wide sections of the hard drive. Counsel’s ability to credibly argue her client didn’t take any company records before destroying “only her personal files” just got harder because it cannot be determined what files were deleted.

Practice Points: Preservation of metadata can be achieved through the use of free write-blocking software that can be installed on a computer, as well as by changing the USB settings on the computer. Doing so will enable the user to freely examine data on the devices without the risk of changing “last accessed” dates and other metadata fields that could prove useful. Metadata can also be preserved through the use of forensic imaging hardware and software tools (which require specialized training), and can be targeted to specific files at issue, or the entire hard drive. In the light of Rule of Professional Conduct 1.1, Competence, and the ease in which data can be lost, altered, and destroyed, it is incumbent upon counsel to rely upon forensic specialists for guidance whenever electronic evidence is involved.

Depending on the type of phone (iPhone, Android, Blackberry), the data you seek might be stored on the phone itself, with the carrier, or with the phone app developer. Furthermore, preserving the data (wherever it may be) will depend on its status, viz. active or deleted. These three factors (make/model, data sought, status) will determine what your digital forensics expert can do for you when it comes time to gather the evidence.
There are two principal methods to obtain data from a cell phone in a forensically sound manner; a logical image and a physical image.

A logical image obtains data from the phone that is accessible on the phone’s file system. You can think of this data as the active data such as call logs, text messages, pictures, GPS location history, instant message threads, etc. A physical image differs from a logical image in that the forensic software targets the physical storage medium directly (the SD card, and built in memory). A physical image will capture active data as well as having the potential to recover data that was previously deleted from the phone. Ideally, the examiner should create a logical image first and then attempt to create a physical image (if deleted content is at issue). This is important because obtaining a physical image entails more invasive work and could render the device unusable.

It is important to identify the make and model of the cell phone to your expert up front so it can be determined whether any one or more of the forensic software suites commonly used by experts can create a logical and/or physical image of the device. New phones, and some much older models, are not capable of being imaged at all, while others can only be imaged logically. The level of security in each model will often determine its forensic-friendliness. In some cases, regardless of which method is used, email data may not be capable of being extracted from the phone even though it appears on it—logging in to the user’s email account may be the only way to preserve such data.

For smart phones, it is important to know where deleted data sets reside. For example, cell phones running the Android Operating System (OS) store text messages in a database file named “mmssms.db.” Apple iPhones store text messages in a database file named “sms.db.” Depending on the type of acquisition (logical or physical) and the forensic software used, these deleted text messages may still reside in the database file itself or within the cell phone’s unallocated/deleted spaces. If a deleted text message is not found in either location, it is possible the client created a backup on his/her computer and/or online that could contain the missing text. For other phone apps, the deleted data may be retained within the application’s database until purged or it may never have resided on the phone other than in temporary memory until the message was posted/deleted via the application’s cloud site.

Practice Pointers: Before calling a digital forensics expert: (1) get the make/model of the phone involved (including the password and storage capacity), (2) determine what you are looking for—active or deleted data, and the type of data i.e. call logs, emails, instant messages, GPS locations, (3) confirm if there is a local backup, and (4) move quickly, especially if deleted data is at issue—the more the phone is used, the greater the likelihood the text/photo/voice message will be overwritten and lost forever. For more information, please contact Maragell, LLC at info@maragell.com or by phone: 856.429.0325.