Friday, September 8, 2017
Struggling to identify the primary user of a computer in your matter? Allow the facts to speak for themselves. Corroborating artefacts beyond the typical documents identified in an electronic discovery exercise will often prove valuable if dominion and control of a particular system is ever called into question.
Take the following scenario: if a computer is handed over pursuant to a search order and forensically acquired by examiners, do you know who used that computer daily if it was in a shared desk space? Was it used solely by the office administrator who worked 8am – 5pm each day? Did others know her logon password? Was there even a password in place? How can one determine the users of the computer at a given time, apart from signed witness statements and, to a greater extent, CCTV!?
Following are ways in which the industry sometimes answers the question of computer ownership:
Following are ways in which a forensics examiner may answer the question of computer ownership:
Have you ever encountered a closet full of laptops with no labels nor asset tags? The aforementioned techniques and examples may prove useful in your cases and could also be used to identify a grouping of unidentified devices seized or turned over. If there are a relatively large number of systems like this, consider using bootable forensic environments that allow the examiners to quasi natively review the contents and parse certain artefacts, without first creating the forensic image(s). This can also be done without modifying the original data and is sometimes referred to as ‘advanced previewing’.
Engage a data forensics expert on your next matter to help light the way and find the facts you need to make your case.
About Timothy LaTulippe:
Tim LaTulippe is a Certified Forensic Examiner and a Senior Consultant with Advanced Discovery’s UK division. Timothy holds a variety of certifications including EnCE, CCE and CCPA, as well a BS in Computer and Digital Forensics and a Master of Science in Data Forensics Management (MSc (Hon)). He has assisted in complex investigations in both the public and private sectors, working with government agencies, Fortune 100 corporations and AM Law 100 firms to provide complete, correct analysis of incidents and issues, and specializes in complex investigations, data privacy, and information security.
Formerly a Senior Forensic Examiner with Digital Forensics, Inc., Timothy has served as an expert witness in a variety of State, Federal and military proceedings. His broad experience includes matters involving trade secret theft, medical malpractice, intellectual property theft, unfair business practice, fraud and internal investigations. Additionally, Timothy is the author of “Working Inside the Box: Real Life Example of GDS in a Forensic Examination,” which was published in The Journal of Digital Forensics Security & Law, and “The Need for Targeted Collections in a Diminished Economy.” He is a member of the Digital Forensics Certification Board, the International Association of Financial Crimes Investigators, the High Tech Crime Consortium, and the International Association of Computer Investigative Specialists.