Microsoft Company FAT and NTFS Digital Forensics Discussion I need help with 2 DIGITAL FORENSICS discussions, please see attachment for more info. FAT and

Microsoft Company FAT and NTFS Digital Forensics Discussion I need help with 2 DIGITAL FORENSICS discussions, please see attachment for more info. FAT and NTFS File Systems
Describe one or two key differences between FAT and NTFS. From the perspective of a
forensic examiner, what are some of the pros and cons of each?
New Hampshire Ball Bearings Vs. Jackson
Case Study
After reading the New Hampshire Ball Bearings Vs. Jackson case, pick Three of the questions
below and answer it in your discussion post. Then describe your overall reaction to the case
and any key takeaways for you
•
•
•
•
What mistakes did NHBB make in its evidence control practices?
What was the result of the IT employee accessing the drive without a write blocker?
What was the significance of the file access times?
What was the significance of the capacity of the USB drive?
What Every Lawyer Needs to Know
About Computer Forensic Evidence
by Sid Leach
Snell & Wilmer L.L.P.
Many years ago, a typical lawsuit would usually involve proofs in the form of
documentary evidence. Hard copies of paper documents would be the focus of discovery
and an important source of proof at trial.
Today, virtually everyone uses a computer at work, and a company’s documents
and business information are most likely to be contained in electronically stored files and
databases. In today’s world, the most relevant evidence is likely to be in the form of
electronically stored information. Electronically stored email communications are likely
to be relevant.
Trade secret misappropriation cases can often be high stakes litigation, involving
significant damages claims and/or being directed to important products or proprietary
technology. See, e.g., DSC Communications Corp. v. Next Level Communications, 107
F.3d 322, 325 (5th Cir. 1997) (jury awarded $369,200,000 in damages, which was
subsequently reduced to $136,732,000, and the judgment on the reduced amount was
affirmed on appeal). Computer forensic evidence may be key to proving a plaintiff’s
case. It can also make the difference between winning and losing for a defendant.
Many companies provide engineers and sales personnel with a company-owned
laptop to use in connection with the employee’s work, and employees are commonly
allowed to take the laptop home. When the employee resigns or is discharged, the
company-owned laptop typically must be returned to the company. If an employee is not
provided with a company-owned laptop, then the employee typically uses a personal
computer or workstation at work, and all such company-owned equipment is usually
retained by the company upon the employee’s departure. Crucial evidence of a departing
employee’s theft of trade secrets may be hidden on the company’s computer equipment.
A forensic examination of a departing employee’s laptop or computer workstation can
provide a goldmine of information concerning what the ex-employee was doing prior to
departure. However, if a lawyer does not take timely measures to investigate or preserve
such evidence, the relevant computer data can be lost because it may be over-written
during normal use of the computer equipment subsequent to the ex-employee’s date of
departure.
In a copyright infringement case where the copyrighted subject matter involves
computer files, computer forensic evidence may be crucial in proving that a defendant
copied the plaintiff’s copyrighted work. For example, in a case involving a claim that a
defendant downloaded copyrighted music over the Internet, a forensic examination of the
defendant’s personal computer may show that file sharing software was present on the
computer, that copyrighted songs were downloaded, when the copyrighted files were
downloaded, and what username was used by the defendant to log onto filing sharing
websites.
A lawyer representing a defendant on the receiving end of a lawsuit will often
need to advise his or her client on how to best defend a lawsuit in which computer
forensic evidence will be very important. In modern litigation, an ever increasing
percentage of the relevant documents are in electronic form, rather than paper form.
Rowe Entertainment, Inc. v. William Morris Agency, Inc., 205 F.R.D. 421, 427 (S.D.N.Y.
2002) (“Electronic documents are no less subject to disclosure than paper records.”).
2
This paper is intended to provide lawyers with important information about the
type of computer data that can be obtained from a forensic examination of computer
equipment. In addition, this paper is intended to assist counsel in making better-informed
decisions about electronically stored information when computer forensic evidence is a
key factor in the case.
A.
Example Cases
The case of AdvantaCare Health Partners, L.P. v. Access IV, 2004 WL 1837997
(N.D. Cal. Aug. 17, 2004), is a good example of why it can be advantageous for a
plaintiff to have a computer forensic expert. In that case, two employees resigned and
began a competing business. The defendants were served with a TRO on the afternoon of
October 6, 2003. The TRO prohibited the defendants from using, copying, or destroying
any of the plaintiff’s data, and required the defendants to permit the plaintiff to make
forensic copies of the hard drives and network servers of their new company. Later that
day, after being served with the TRO, one of the defendants visited numerous websites
searching for computer data deleting software. That evening, the defendant obtained an
anti-forensic software program called BC Wipe, and over the next four days deleted more
than 13,000 files from his home computer using BC Wipe. Id., at *2.
The plaintiff hired a computer forensics expert. The forensic expert was able to
show that one of the defendants had accessed his former employer’s computer network
and copied a large number of the company’s files prior to leaving, including files
containing company policies and procedures, patient databases, employee lists, and
contracts. The forensic expert also determined that the defendant tried to conceal his
copying activities by deleting copied files from his hard drive. Based on the evidence
3
developed by the computer forensic expert, the plaintiff obtained a sanction instructing
the jury to that they must find that the defendants copied all of the files on the plaintiff’s
computers. Id., at *11.
The case of New Hampshire Ball Bearings, Inc. v. Jackson, 158 N.H. 421, 969
A.2d 351 (2009), is a good example of why it can be important for a defendant to have a
computer forensic expert. In that case, the plaintiff company had a history of suing
departing employees and accusing them of trade secret misappropriation. The plaintiff
company had its own IT employees trained in computer forensics, and had the software
and equipment to make a mirror image of the hard drive of every departing employee’s
computer so it could be examined for suspicious activity. Only a few months after losing
the last case it filed against a departing employee, the plaintiff sued another departing
employee, who was later found to be innocent of trade secret misappropriation by a jury.
Prior to filing the lawsuit, an IT employee was instructed to take the hard drive
that had been used by the departing employee out of the safe in New Hampshire. Instead
of using the software and equipment available in New Hampshire to make a forensic
image of the hard drive, (which he was trained to do), this IT employee was instructed to
get on a plane and take the hard drive out to the company’s offices in California,
allegedly so the hard drive could be used in yet another class that the employee attended
to gain instruction on the use of computer forensic software. In this instance, a private
class had allegedly been arranged for just two of the company’s IT employees.
After arriving in California, the IT employee was told that the class had been
cancelled, and to return back to New Hampshire. Although the director of IT had told
him before he got on the plane not to let the hard drive out of his sight, those instructions
4
were overruled by someone in California, and he was told to leave the hard drive in
California where they would take good care of it. After he left, another IT employee in
California accessed the hard drive without using a “write block” hardware device he had
on hand, and which he knew he was required to use to prevent any changes being made to
the contents of the hard drive.
After the hard drive was accessed without a write block device, the IT person in
California made a forensic image of the hard drive before the class was rescheduled for
the following week. Allegedly, when the forensic image made in California was
examined during the class, they claimed that some files on the hard drive had sequential
access times. A new forensic expert was retained who had never done any work for the
company, (even though the company had an established relationship with a large
nationwide reputable computer forensic firm that had been used in the company’s prior
cases), and the expert was provided with the forensic image that the IT employee in
California had made. No mention was made to the computer forensic expert of the fact
that the hard drive had been accessed without a “write block” device. The computer
forensic expert then signed an affidavit stating that, in his opinion, the sequential access
times on the files was evidence that the former employee copied trade secret files from
his company-owned laptop prior to departure from the company.
The plaintiff provided false interrogatory answers stating that no one had accessed
the departing employee’s computer hard drive, and no data had been altered or modified
on the hard drive. The plaintiff also provided false interrogatory answers that omitted the
name of the IT employee in California from the list of people who had possession of, or
5
access to, the former employee’s computer and hard drive after it was returned to the
company.
The former employee and his new employer were sued for trade secret
misappropriation. The defendants retained a computer forensic expert. The defendant’s
expert discovered that the hard drive had been accessed without a write-block device
after the employee turned it back in. The plaintiff was forced to amend its answers to
interrogatories, and admit after the close of discovery, that the IT employee in California
had accessed the hard drive, and had done so without a “write block” device. In addition,
the defendants’ expert testified that the trade secret files allegedly copied by the former
employee would not fit on the thumb drive he allegedly used, because it did not have
sufficient memory capacity to store those files along with his personal files that were
undisputedly copied at the same time. At trial, the jury found in favor of the defendants
on the trade secret misappropriation claim. If the defendant had not had his own
computer forensic expert, the evidence raising questions about the plaintiff’s forensic
image of the former employee’s hard drive would never have come to light.
B.
Computer Forensics
Computer forensics deals with the preservation, identification, extraction and
documentation of computer evidence. Computer forensic investigations take advantage of
the way computers store and retrieve data. Relevant computer data usually includes
information stored in files on a hard drive, as well as information in files that were
“erased” from the hard drive. Computer forensics also takes advantage of the way
personal computers operate, and the temporary and/or permanent information recorded
by the operating system during normal operation. During normal operation, a Windows
6
operating system on a PC will record data identifying thumb drives that were connected
to a computer, the date and time a file was last accessed or modified, Internet searches,
Internet websites visited, email read or sent using the computer, and computer programs
that were installed or used on the computer.
This paper will focus on computer forensic evidence available on a personal
computer (“PC”) employing Windows as the operating system. For simplicity of
illustration, the specific examples and details discussed in this paper, unless otherwise
noted, are for Windows XP because it is a common operating system used in business
enterprises. However, much of the discussion also applies to Windows 95, Windows
2000, Windows Vista, Windows NT, Windows 7, and personal computers running other
operating systems.
1.
Computer Forensic Images
A forensic image of a computer storage device, (e.g., a hard drive of thumb
drive), is an exact replica, bit for bit, of the contents of the original storage device. New
Hampshire Ball Bearings, Inc. v. Jackson, 158 N.H. 421, 424, 969 A.2d 351, 356 (2009)
(“A forensic image is an exact replica, bit for bit, of the original storage device that
allows investigation of past use without altering the original evidence.”).
The forensic image of a computer hard drive is sometimes referred to as an
evidence file. The copy of the contents of a hard drive that is provided by a forensic
image is different from the copy produced by copying all of the files saved on a hard
drive using a program like Windows Explorer. A forensic image of a computer hard drive
contains the entire contents of the hard drive.
7
Electronic data, including forensic imaging of hard drives, is within the scope of
discoverable material. In re Pharmatrak, Inc., 329 F.3d 9, 17 (1st Cir. 2003); Antioch Co.
v. Scrapbook Borders, Inc., 210 F.R.D. 645, 652 (D. Minn. 2002). Because electronic
discovery can easily become broad and intrusive, “[c]ourts have been cautious in
requiring the mirror imaging of computers where the request is extremely broad in nature
and the connection between the computers and the claims in the lawsuit are unduly vague
or unsubstantiated in nature.” Balboa Threadworks, Inc. v. Stucky, No. 05-1157-JTMDWB, 2006 U.S. Dist. LEXIS 29265, 2006 WL 763668, at *3 (D. Kan. Mar. 24, 2006).
Without a sufficient showing of relevance and need, courts disallow the “drastic
discovery measure” of permitting a party to image all of an opponent’s electronic media.
McCurdy Group v. American Biomedical Group, Inc., 9 Fed. Appx. 822, 831 (10th Cir.
2001). Courts are more receptive, however, to circumscribed requests limited to specified
individuals or computers expected to produce relevant information. See Rowe
Entertainment v. William Morris Agency, 205 F.R.D. 421, 427-28, 432-33 (S.D.N.Y.
2002) (granting revised and limited request for defendants’ backup tapes and emails and
prescribing protocols for imaging); Simon Property Group L.P. v. mySimon, Inc., 194
F.R.D. 639, 641 (S.D. Ind. 2000) (granting access to computers used by four named
individuals); Playboy Enterprises, Inc. v. Welles, 60 F. Supp.2d 1050, 1053 (S.D. Cal.
1999) (granting access to defendant’s personal computer).
The most commonly used computer forensic software package is EnCase Forensic
produced by Guidance Software, Inc. According to Guidance Software, EnCase software
is used by more than 15,000 forensic experts and investigators. State v. Butler, 2005
Tenn. Crim. App. LEXIS 302, at *8 (Tenn. Ct. Crim. App. March 30, 2005) (Encase has
8
been approved by several federal district and appellate courts as a “non-invasive forensic
examination tool.”). EnCase is reliable software and may be used for the purpose of
creating a forensic image of a hard drive. State v. Plude, 2007 Wisc. App. LEXIS 194, at
*10 (Wis. Ct. App. March 6, 2007) (“EnCase makes a mirror image copy of a hard drive,
without altering the original drive.”).
2.
Computer Forensic Evidence
A computer forensic expert can analyze a forensic image of a storage device to
determine what was stored on the device, what files were accessed, and when the files
were last accessed or modified. In addition, a forensic image of a PC hard drive includes
data from which an investigator can determine what peripheral devices have been
connected to the PC. New Hampshire Ball Bearings, Inc. v. Jackson, 158 N.H. 421, 42425, 969 A.2d 351, 356 (2009) (“Analysis of the forensic image with forensic software
allows an investigator to determine what peripheral devices have been connected to the
device, what a user accessed, what has been stored on the device, and when it was last
accessed or modified. Because deleted files are not actually erased from storage media,
analysts are able to determine both current and deleted files so long as the latter have not
been completely overwritten with new data.”).
If you are a potential plaintiff in a case in which computer forensic evidence may
be important, get a computer forensic expert at the outset, before a complaint is filed.
Some companies have the software and equipment available to make a forensic image of
a departing employee’s computer before anyone else uses the computer. This, of course,
is the best practice, and the expense of doing so may be warranted in companies whose
successful business operations depend heavily upon effective trade secret protection.
9
On the other hand, cases have been successfully litigated where evidence was
obtained from a departing employee’s computer even when no special efforts had been
employed to preserve the computer forensic evidence that was later discovered on the exemployee’s computer. See, e.g., DSC Communications Corp. v. Next Level
Communications, 107 F.3d 322, 325 (5th Cir. 1997)(“DSC filed this lawsuit in April,
after [a competitor] first announced its investment in Next Level, when it reviewed the
files saved on [the ex-employee’s] computer at DSC and found three pages of Next
Level’s May business proposal.”).
Another reason for recommending that a plaintiff retain a computer forensic
expert from the outset is the fact that, if the plaintiff intends to request that mirror images
be made of the defendant’s computers in order to obtain forensic evidence, it is advisable
to image the computers sooner rather than later. An adversary’s computers may have
relevant information that may be lost through normal use of the computers. Antioch Co.
v. Scrapbook Borders, Inc., 210 F.R.D. 645, 652 (D. Minn. 2002) (ordering defendants to
allow plaintiff’s expert to make a mirror image of defendants’ computer hard drives
because the computers may have relevant information which is being lost through normal
use of the computers).
If you are a defendant in a case in which computer forensic evidence is an
important part of the plaintiff’s case, it is advisable to retain a computer forensic expert as
soon as reasonably possible. Defendants have lost cases because they failed to retain a
computer forensic expert at an early enough stage in the case. See, e.g., State v. Plude,
2007 Wisc. App. LEXIS 194, at *13 (Wis. Ct. App. March 6, 2007) (defendant’s attempt
to blame the prosecution for his failure to present exculpatory computer evidence at trial
10
rejected on appeal, on grounds that it was the defendant’s own fault due to “his failure to
timely hire a computer expert.”).
In addition, a defendant in a trade secret misappropriation case involving
computer forensic evidence will want to comply with its obligation to preserve relevant
evidence. “A party or anticipated party must retain all relevant documents … in existence
at the time the duty to preserve attaches, and any relevant documents created thereafter.”
Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003). Although there
may be a “multitude” of ways to comply with the duty to preserve evidence, “a mirrorimage of the computer system taken at the time the duty to preserve attaches” may be one
component of a litigant’s evidence preservation efforts. Id. Generally, someone skilled in
computer forensic evidence must be retained to make the mirror images of the relevant
computers.
An unscrupulous plaintiff can take advantage of a defendant’s delay in retaining
its own forensic expert. A defendant may be …
Purchase answer to see full
attachment