Chapter 11 – What happened to M’s Email?

Recall that the 120 gig hard drive was the original hard drive and in use by M from December 2001 or so to a few days before he claimed it crashed…about May 8, 2003. We also shared with you the fact that the forensic reports confirm that and Outlook email account was active and there were files saved and archived just prior to the alleged crash of the computer. The report also confirmed that the deletion of the archived file and reformatting of that hard drive no doubt resulted in an ability to recover all of the emails. M confirmed that he had reformatted the hard drive.

After the alleged hard drive crash incident, M replaced the 120 gig hard drive with a 60 gig hard drive. And on that hard drive, no email traffic at all was found. In fact, an Outlook email account was created by Mon the day he returned the computer equipment to us.

Much of M’s case centered around an allegation that he received a spreadsheet via mail from an employee, someone he initially refused to name. By initially I mean he refused to name him for 7 years. He also claimed that he did not receive from me his email notice of termination, nor the letter of termination sent first class mail, before he filed a complaint with the Oregon Department of Justice. We of course maintained our email evidence. He of course did not.

But let’s be clear, M testified that he maintained an Outlook email account on the 60 gig hard drive from the time he took it over to the time he turned it over to us. But we did not find any email M, not a single email. In fact he did not set up the Outlook account until 1 am the morning he returned the computer to me.

Lets see what the Forensic report on the email accounts concludes. But remember that M was getting regular advice by Sandra Ware, his girlfriend at the time. I don’t think they ever married.

The Forensic Report was generated by Steve Williams and excerpts from that report follow:

“I was requested to perform a forensic examination of a 60 GB hard drive to ascertain the email usage pattern of M. This 60 GB hard drive is reported to have been used by M as a replacement hard drive for a 120 GB hard drive that is reported to have failed in May of 2003. I used the EnCase forensic software to create a forensic image of the 60 GB hard drive on April 10, 2009, using a hardware write blocker, to prevent any changes of data to the hard drive.

Forensic Report Cox on 60 gig 120-3

Forensic Exhibit Cox on 60 gig 120-21


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s