Archive for computer forensics

First Anniversary Attendees Learn How to Use Investigative Databases

HADDONFIELD, NJ – OCTOBER 10, 2013 – Maragell Corporate Investigations celebrated its first year in business on October 10th with a ribbon-cutting ceremony and interactive community open house. The company, which until 2012 operated as the U.S. office of Intelysis Corp., benefited from an upturn in the region’s economy. “We saw a marked increase in investment activity by hedge fund and venture capital clients, which use our services to conduct background checks on prospective portfolio companies,” said Jeffrey Brenner, Esq., NJLPI, the company’s founder. “Our team was also brought into several complex computer forensic investigations, including theft of intellectual property, bankruptcy fraud, and employee violations of restrictive covenants,” he added.

As part of the open house festivities, Maragell’s staff demonstrated several insider investigative techniques. Team members accepted computer hard drives from attendees and demonstrated how data the users thought was permanently deleted could still be retrieved. Then, using the U.S. Department of Defense data destruction standards, they wiped the hard drives, enabling them to be recycled without fear of data loss or identity theft.

Brenner and his team also amazed guests by broadening their understanding of the power of the Internet, showing that many of the same tools used to locate to locate lost friends and loved ones can be used to track down missing persons, debtors, and witnesses. Similar strategies are also used to conduct pre-employment background checks. Maragell’s researchers demonstrated how these checks are conducted and why they are more of an art form than an exercise in data input/output. Combining multiple sources of public information, investigative databases, social media sites, and Google, together with data provided by the subject (in this case one of Maragell’s employees), the demonstration revealed how a PI reads the tea leaves and assimilates the information to create a complete, and accurate, picture of the subject.

Maragell completed the day with a demonstration on how computer forensic experts hunt for evidence of wrongdoing through the use of keyword searches and deleted emails. Of note was the fact that words such as “non-compete” and “breach” which might be expected to return relevant information about an employee’s plans to violate his or her contract, were shown to appear in many forms and locations having nothing to do with the facts of a case. “Poor keyword choices can cost a client thousands of dollars in eDiscovery costs and attorney review time, and we make every effort to avoid this pitfall with highly strategic searching,” said Brenner.

Unloading Electronic Social Media “Baggage” May be Hazardous to the Health of Your Case


Social Media ediscovery

Computer forensics and social media


You already know that the privacy settings on many social media websites are not as private as you want, and that “delete” doesn’t really mean delete.  But did you also know that if you try to unload some of that electronic “baggage” to improve your online presence, you might fall into even hotter water?  That’s what one New Jersey plaintiff learned the hard way in the case of Gatto v. United Airlines and Allied Aviation Services., et al., No. 10-CV-1090 (D.N.J. March 25, 2013).



Gatto, a former baggage handler at John F. Kennedy Airport, sued United Airlines and Allied Aviation Services for damages when a set of fueler stairs crashed into him while he was unloading suitcases from an airplane.  He claimed his injuries left him permanently disabled, and that his disability limited his physical and social activities.

In the course of discovery, the defendants sought authorization from Gatto to access his social media and online business accounts, including sites such as Facebook, PayPal and eBay.  Gatto complied with the request for many of his accounts, but not Facebook.

On December 1, 2011, during a settlement conference, the parties worked out an agreement that would give (and did give) the defendants access to Gatto’s Facebook account.  However, shortly thereafter, after receiving an alert from Facebook that someone had accessed his account from an IP address in NJ unknown to him, Gatto deactivated the account (he claimed he thought it was hacked).  When the parties tried to re-gain access, it was determined that all of his information was gone.

The defendants then subpoenaed Facebook (and provided a copy of Gatto’s authorization) seeking all the account information directly.  Facebook responded to the subpoena with its usual defenses regarding the Stored Communications Act (which it claims prevents it from disclosing all information), but more importantly, it advised that all the account data had been automatically deleted once the 14 day reactivation period expired. (There was some discussion in the opinion as to whether Gatto merely deactivated his account or went further and intentionally wiped it out, but the issue became moot in the end).

Based on several screen shots of Gatto’s Facebook page that were printed by one of the attorneys for United which showed Gatto engaging in activities that were inconsistent with his testimony, the defendants moved for sanctions against Gatto for destroying evidence they believed would have further shown that Gatto was not as limited as he claimed.  The court granted their request for an adverse inference at trial ruling that it was

[c]lear that Plaintiff’s Facebook account was relevant to the litigation. Plaintiff alleges to have sustained serious injuries in this personal injury action, and further alleges that said injuries have limited his ability to work and engage in social and physical activities. The Facebook information sought by defendants focused upon posts, comments, status updates, and other information posted or made by the Plaintiff subsequent to the date of the alleged accident, as such information would be relevant to the issue of damages.

The Court finds that it was reasonably foreseeable that Plaintiff’s Facebook account would be sought in discovery. Defendants requested Plaintiff’s Facebook account information as early as July 21, 2011, nearly five months before Plaintiff deactivated his Facebook account. Furthermore, Plaintiff’s Facebook account was discussed during the December 1, 2011, Settlement Conference, where Plaintiff was present and the Court order related to the discovery of information associated with Plaintiff’s Facebook account. Accordingly, it is beyond dispute that Plaintiff had a duty to preserve his Facebook account at the time it was deactivated and deleted.

A copy of the Gatto decision can be downloaded here:

Gatto v United Airlines et al.

The takeaways from this ruling are many-fold:

For the socialite who enjoys posting pictures of anything that pops in front of his/her camera or the earth-moving thought that creeps into his/her mind, or better yet, the cell phone user who activates software that automatically updates his or her whereabouts (“Sally just checked into Starbucks at 3rd and Vine…”) these life moments could become Exhibit A at trial.  Alternatively, deleting them could result in the case being dismissed.

For the plaintiff’s attorney, social media sites can help assess the veracity of a client’s story.  Better to know up front that your client is stretching the truth or corroborating his case.

For the defense attorney, early preservation letters with detailed instructions regarding what to preserve and what not to destroy or terminate can help with early case assessment or serve as a basis for a successful spoliation motion months or years later.

For all litigants, knowing how to preserve these online life-storehouses is paramount.  Printing screenshots is sophomoric, but may be enough to prove a point.  Capturing entire accounts, in real time, using forensically sound techniques, may be a game changer. And for those awkward posts and pictures, once the accounts have been preserved forensically, the good news is they can be deleted from the active account without fear of retribution.

Brenner to Present at PBI Business Divorce Seminars

Jeffrey Brenner, managing principal of Maragell, LLC, has been requested by the Pennsylvania Bar Institute to serve as a panelist at its full-day Business Divorce seminar that will take place on several dates across the Commonwealth:  March 4th (Pittsburgh), March 7th (Mechanicsburg) and March 11th (Philadelphia).

He will join a panel of experts in fields of corporate law, litigation, and business valuation.  Brenner will cover issues relating to the role IT plays in a business separation, and the preservation and analysis of electronically stored information for use in litigation, including data stored on smartphones, tablets, and cloud-based applications.

Brenner specializes in computer forensics and corporate investigations and has been retained by numerous businesses, insurance companies, governmental agencies, and school districts to assist with their electronic investigation needs.

The seminar has been approved for 6.0 PA CLE substantive credits including ethics.