Chapter 7 – The 120 Gig Hard Drive

As I indicated in my last post, M put the computer he used (and the 120 gig hard drive in it) in play in December 2001. And that 120 gig hard drive continued to be the primary hard drive he used until May 2003, when he claimed it crashed. What the forensic evidence shows is that in spite of the position M took on the crash of the 120 gig hard drive, it continued to be used by him until I took possession of it on the afternoon of November 13.

M also took a position that the hard drive was placed in a safe within a few days after it crashed and it stayed there until he returned it to me. But the forensic evidence shows it was until continuous use after the alleged crash.

M also testified that at some point he decided to reformat the hard drive. The “at some point” was the day he returned the hard drive to me. And when asked why he destroyed evidence even after he had filed a complaint against us, he claimed he did not was client sensitive data falling into hands outside of the company. Of course under that theory he would also have reformatted the newer 60 gig hard drive & of course he no authority to destroy our data, our programs and our evidence. But he did.

In addition to the hard drive being reformatted, many files were deleted. The actions taken to cover up data…again data we owned, was substantial, measured and strategic.

Mark Cox was one of our experts and his reported that “An analysis of the hard drive was conducted for usage between the dates of May 12, 2003 and November 12, 2003, the time that the hard drive was reported to be unusable. Exhibit 3 is included to indicate the usage during this time frame in which the hard drive was reported to have been in a failed state. From the recovered files present on the hard drive that were created or accessed during this time frame, it is apparent that the hard drive was not in a failed state and was being used, mainly for downloading video files.”

What video files did we find? Here’s a portion. And note the last date the file was accessed as in deleting and the column on the right the date and time the file was created. There were thousands of video, jpeg and mp3 files deleted:

Lost in Space – S2ep12 – A Visit to Hades-[SFCC].r04 11/12/03 10:45:06AM 06/22/03 11:17:31PM
Hitch-Hikers Guide Galaxy2 Ep1.mp3 11/12/03 10:45:03AM 07/23/03 10:09:07PM
Wonder.Woman.1×05.svcd.BTM.r34 11/12/03 10:47:09AM 07/26/03 09:42:34PM
Engineering Disasters 4_HIS!.sfv 10/08/03 10:16:02AM 08/03/03 07:52:20PM

And of course there were titles indicating there was porn. Lots of titles, but here’s one:

Gay_Older_Men_-_Quadraplex_Part_1.avi.lnk 04/01/03 07:29:49AM 04/01/03 07:28:46AM

Sandra Ware, I thought you were engaged to Max.

Lots of Ebay files:

eBayISAPI[3].htm 05/08/03 05:32:38AM 05/08/03 05:32:38AM
max@www.andale[1].txt 03/18/03 08:00:04AM 03/18/03 08:00:04AM

You can find the Forensic Report here examination_of_120_gb_hard_drive_old. The detailed exhibits are not necessary and excel files with 50,000 lines of files deleted are not necessary either, but we will add this later if necessary.

And what about the years of Foxpro files and data files and other highly confidential information? And the problem is that this computer was used to upload and download many of these video files, subjecting a lot of this data to theft.

Sometimes employees working in the programming field lose sight of the fact that they do not as individuals own their programming. The employer does and it is not their right to destroy it. In fact it is a criminal act. We also have a forensics report on what happened to the Foxpro files. M maintained that the Foxpro files could easily be recovered and yes that would be substantially true if the recycle bin was not emptied and the hard drive had not been reformatted. Once the drive was reformatted the Foxpro programs could not be recovered with any integrity. We were able to recover enough however to know that M did not create many of these files. We don’t know who did. We don’t know where most of them came from, but I’m guessing from someone who had better programming skills than M.

And to boot the Foxpro files we needed were not on the 60 gig hard drive he turned over to us, the one he was using on his last day. More on the 60 gig hard drive shortly, but next lets count what Bill Crow set aside to find in M’s favor.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s