Chapter 4 – The Forensic Reports

In the next 48 hours we will provide summaries of the forensic reports and attach them for your perusal. You’ll be surprised by this. There is irrefutable evidence that a hard drive M claimed was broken, reformatted and in a fireproof safe was used to store movies, music, ebay files and  and .htm pages. I don’t think we have ever bothered to recover and open the htm files but I am curious and think we will do so now. T

Much of the forensic evidence we examined can be broken down into two broad groups. The first group is the hard drives, personal and company computers M used while employed by us. Anything that M touched for the company business we wanted to have examined forensically. The second group is a floppy disk I used to save a draft of M’s termination letter and my computer hard drive on which was stored my email terminating M. I have written this many times but suffice it to say that M did not turn over any of his personal computers or personal hard drives or other digital mediums used by him to perform his duties while employed by us.

And so the forensic evidence on M’s use is contained on a 120 gig hard drive and 60 gig hard drive. The 120 gig hard drive was the original hard drive used and one of the forensic reports for that drive follows. The 60 gig hard drive replaced the 120 gig hard drive after it crashed. We expected to find many of our data processing and reporting program files. The programming allegedly done by M over the last two years was not there of course, but that’s another story. In an earlier post I confused the 120 gig hard drive and the 60 gig hard drive. But the order is the 120 gig hard drive was the original hard drive on a computer purchased for M’s use and the hard drive was used from its initial use to May 2003, at which time M took the 120 gig hard drive out of service and used it to deposit his personal Videos, Movies and Music. The 60 gig hard drive was used from May 12, 2003 until well after M returned it with the business computer. He returned it to us on November 13, 2003.

The key issue here is that neither party should destroy the computer, digital evidence. We did not. Even after Max’s attorney told us not to…and again we did not destroy anything…Max still chose to destroy his computer. Had this been in state court, Max’s case would have likely been dismissed. We filed a motion with Crow. He did not dismiss the case.

A component of the computer evidence was the emails between me and M and others. He claimed he received an email with this alarming evidence of over billing clients (via an email from one of our employees, an email he did not turn over). The evidence was and is an excel spreadsheet. But again he did not turn over the email. When he returned this company computer (with a 60 gig hard drive) he had created an outlook email account, but it was created the day before he returned it to us and there was no email account for M. And where were his emails? Again, not on the computer he returned. The emails were never there. The emails were on one or more of his personal computers, one’s he destroyed. We filed a motion to dismiss the case based on this destroyed evidence. Bill Crow refused to dismiss. We kept all of our emails and turned them over. He provided some emails but since they were not housed on the computer hard drive he returned to us when he was terminated, where they came from was a material point.

To properly frame this discussion, there is a history of M’s business computer (the one we owned) we need to explore. First, the original hard drive on the computer we provided M was small (120 gigs), but in 2003 120 gigs was still pretty good. Some six months before I terminated M I visited him in New Jersey. During that visit and while showing me his programming skills the hard drive appeared to crash. M was pounding the keys pretty quickly and strongly & it locked up. But it did not blue screen. M maintained that this 120 gig hard drive was not usable thereafter, although he was able to recover program and data files. Max requested a replacement, which we of course accommodated…and he installed a new 60 gig hard drive to replace the 120 gig hard drive.

Why this history is important is that after M claimed the 120 gig hard drive was broken, he continued to download and store personal files on that hard drive. One of the more salient and threatening conclusions we reached was that M was downloading and uploading files on a public sharing site. M had access to credit card data. He was after all our IT manager and it is with regret that some of that personal information may have made its way to the internet. The computer was not protected as our company protocol required. The forensic report will show that as well. And that would have been a firing offense had we known about it while he was still employed by us.

But more than anything else we seen thousands of movies, including titles indicating the movies were porn, downloaded and uploaded to this public file sharing service. Said service allows you to download when you upload. Lots of movies. Lots of music. A trademark and copyright violation bonanza. The FBI was notified. The New Jersey State Police was notified. The community was notified. You never know whats in your neighbors or best friends closet. You just never know. The forensic reports tell us this activity happened while M was in possession of the hard drives.

The other inference we can draw from the 60 gig hard drive use was that there was a reason that no email evidence of M’s email was on that 60 gig (new) hard drive. That means that at the time M installed the new hard drive, he had decided to not install an outlook email account on that hard drive and to control the evidence of the emails sent to him and from him thereafter. That also means he was plotting his lawsuit for at least six months before he was terminated. M did not turn over one of his personal computer with his email activity from the time the 60 gig hard drive was deployed to the time he returned said hard drive to me. He turned over emails in hard copy form only. This is very blatant evidence destruction.

But as of today legal counsel for M, Linda Marshall, demanded that we not publish the forensic reports claiming that there was a protective order keeping the confidential information each party provided protected from public disclosure presumably outside of the arbitration. I presume that Max’s personal financial data was not covered by this alleged protective order. I have not found the order as yet but even if his personal financial data was not covered by the order we still would not produce or publish it.

M did not provide a personal computer, not a single hard drive used by him while working from his home, for examination by our forensic experts. The forensic data that was examined by our two forensic experts was the property we owned, including the hard drives from the computer M used during his employment with us. And as I previously noted our forensic experts also issued forensic reports on the computer I used to send and receive emails, specifically addressing whether the email terminating M was sent before he filed a complaint with the Oregon DOJ. M provided no forensic data at all. He provided documents in pdf form & loaded on a flash drive and I recall reaching conclusions that he must have downloaded documents from a source other than the computer hard drives he provided to us…but there was nothing else.

Having reviewed the forensic reports, it covers exclusively our property. And we are free to disclose the conclusions reached on our property. I can imagine that they (Marshall, M, Ware) would not be since the hard drives examined were our property.

Several of the forensic reports were generated over 10 years ago and were published to the FBI, New Jersey State Police and Woodbury New Jersey Police. It’s why M was interested in settling the case in 2006 or so, and for a small amount of money. We would have been happy with a walk away even though he destroyed key programming and documents. Nonetheless that evidence has been published and republished many times.

The forensic reports prepared for trial were a bit broader. We wanted to hone in on the fact that the last hard drive M used was not used to send and receive email. Slam dunk. It was not there…ever. But more importantly we wanted the arbitrator to see the names of the movies and music downloaded. And we wanted to showcase that the software we used, years of programming, was being used on that hard drive and was deleted. And in spite of the fact that we were told the 120 gig hard drive had crashed, Max did continue to use it, as we pointed out before.

We will be publishing the forensic reports. But will allow a few more days to see if we can find that protective order and make sure no part of it is attributable to personal property turned over by M. We will also make sure that no such data such as client files and the like will be covered in the report. We will redact that information.

We will publish the police report. And by the way finding movies and titles indicating porn was not surprising. Yes it was disappointing that such an abuse happened, but M worked from home. Probably happens a lot and I feel no moral outrage over this. But the massive amount of the movies and music did surprise me. Folks, keep your porn and other movies and music on your personal computers not on one owned by your employer.

We will publish the arbitration transcripts. We will publish other supporting information.

Sandra, M would not have destroyed his personal computers had he not been advised to do so. That should have been transparent to Bill Crow. And you can be disbarred for making that recommendation, if you did. Of course at the beginning of every session he did open up with “Ms. Marshall where did we leave off on your case.” We were actually the plaintiff.

The forensic reports do nothing but support our position. The key issues the forensic reports address are what was going on with hard drives and when were files created, to recover and report on outlook pst files (email), to identify what was going in with the email accounts and who did them, to identify unauthorized use of the hard drives and to determine if the email I sent terminating Max was sent when we claimed it was and whether that email went out before Max filed his complaint. They were also tasked to determine what happened to the Foxpro files and all the programming generated by Max and our other IT employees. The last of these points was necessary because once M was no longer with the company, our existing IT staff could not find the programs and we had to shut down for a week as we recreated them.

As a matter of disclosure we will redact any information addressing financial data as well as names of movies suggesting the downloaded file may have been more than just porn.

More details to follow.

And Linda Marshall just sent a letter to counsel demanding that we not issue the forensic reports & shut down the blog. I don’t really understand their fear.

Free speech. Opinion Speech. The forensic reports and all other litigation information were property of the parent company of the Northwest call center group, a corporation called Northwest Direct Marketing.

And while I initially wrote that “we” are charged to monetize this experience as much as possible, the truth is that we have not attempted in any way to do so. The blog has not been marketed in any way. This is not a product of an otherwise inactive corporation or group of corporations. That group is no longer active.

I alone am telling this story. In order to tell a complete story I must explained what one of my companies (Northwest Direct Teleservices, Inc.) was charged with, who made the claim, how we defended it, whether the claim had merit, what we found when we did forensic analysis,  and everything else that impacted the arbitration decision. In doing so we are potentially exposing Northwest Direct Teleservices, Inc. to the public’s attention and in particular to the claim by M that we fraudulently billed clients. While I found that claim defamatory and proved we did not over-bill clients, the allegation remains a part of our permanent record. I could carry on and say how will we ever over come that but we do not need to. Frankly no client of ours ever believed it. They were not given reason to.

The company nonetheless suffered from the loss of revenue and other very specific damages that arose when the IT department fell apart after Max’s last day. The remaining members of the IT department could not process data and generate reports. They left a short time thereafter.

And we asserted those damages. Northwest Direct Teleservices was the Plaintiff and we sued M to recover damages. More on that later.

The 120 gig hard drive report R – examination_of_120_gb_hard_drive_old

The 60 gig hard drive report R – Examination of 60 GB Hard Drive Email