Questioing the integrity

[I'mTheFather]

>> That is not a case of the image degrading. You seem to state that, because it's been a long time, the image may have changed. Tampering and degradation are two entirely separate things.

Sorry for my poorly worded statement and thanks for your input.
More time means more ways to do tampering and more ways to coverup the tampering. Time is one of the key reasons why the court gave a specific deadline to the local company to submit the image to NY expert.

Do you think the court is concerned that the forensics company will tamper with the evidence??

 

[quincy]

Thanks Zigner

>> The quality of the forensic image does not degrade just because it wasn't forwarded in the time period required by the court.

Yes, it can degrade if it is modified. More time means more ways to do changes and more ways to coverup.

>> Why would YOU file anything with the police?

I already answered (please read once again): I did not file case. The police are involved with the explosion case that's all.

The arguments made against admitting forensic evidence are generally based on claims of a broken chain of custody or on the authenticity of the data. The testimony of a forensic examiner will include proofs that the original media was not altered.

Forensic examiners carefully document all that they do and they will then certify the results of their exams. It is very hard to argue successfully against the evidence found on a computer. Because another forensic exam of what is presented can easily discover tampering or changes in the media, a forensic examiner is not going to risk his reputation by modifying or changing the media.

Seriously, leventhal, I think you might want to concentrate on a defense to what you wrote instead of on the validity of the evidence of this writing that might have been found on your computer. The attorney you see can assist you in making arguments in your defense that are not so easily defeated.

 

[leventhal]

Yes, I do. Else, why the company did not submit until now, despite my reminders. Company is not a building but consist of a group of people. Any one from that group can do any nasty thing just because as simple as they do not like my English or my face! A company which lied saying that I never submitted the computer (and later took a U-turn) can do any other nasty thing.

 

[quincy]

Yes, I do. Else, why the company did not submit until now, despite my reminders. Company is not a building but consist of a group of people. Any one from that group can do any nasty thing just because as simple as they do not like my English or my face! A company which lied saying that I never submitted the computer (and later took a U-turn) can do any other nasty thing.

These are arguments best left on this forum and not used in court. They are a bit silly and a court is unlikely to consider them anything but silly.

The forensics team more than likely made more than one exact copy of what they found on your computer. These duplicates can be compared, if there is a question of altering data.

You need a defense to what you wrote. I think it would be smart to work on that with your attorney. The attorney will guide you in the right direction.

 

[leventhal]

Thanks Quincy.
The forensic company made exactly one copy of the image: that is what they said long ago when they took the 2nd U-turn.

>> Because another forensic exam of what is presented can easily discover tampering or changes in the media...

Who conducts the other forensic exam? On what data/disk they conduct? Who asks for this other forensic exam? When? Who pay for this?

FYI: The NY examiner's duty is just to examine (the forensic image they receive) to check if some documents (claimed by the Plaintiff) are there in the forensic image he receives from the local company. The local company has not yet send the image to NY.

 

[quincy]

Thanks Quincy.
>> Because another forensic exam of what is presented can easily discover tampering or changes in the media...

Who conducts the other forensic exam? On what data/disk they conduct? Who asks for this other forensic exam? When? Who pay for this?

FYI: The NY examiner's duty is just to examine (the forensic image they receive) to check if some documents (claimed by the Plaintiff) are there in the forensic image he receives from the local company. The local company has not yet send the image to NY.

A court can order another forensic exam if there are legitimate concerns raised about the authenticity of the data and this data is necessary for the case to go forward. Otherwise, the computer evidence will stand as is and be given the weight it deserves.

A jury can be informed that the computer in question was destroyed and they can use this as a factor to weigh against the defendant.

I suspect that the one claiming you wrote "bad things" has other evidence to present to the court that shows what was written, and the computer data is only to support this evidence as having come from your computer. Many times the computer examination results are not even necessary to a plaintiff's case.

Again, seek help from an attorney in your area. I think you are veering off in a direction that is bound to lead you to a dead-end. In other words, the forensic exam should only be one line of defense against the claims against you. You will probably need others if you hope to be successful.

Good luck.

 

[leventhal]

Many thanks, Quincy, I got your message and will do accordingly.

Really appreciated!

 

[quincy]

Many thanks, Quincy, I got your message and will do accordingly.

Really appreciated!

You're welcome, leventhal. Thank you for the thanks.

I wish you good luck in the case filed against you.

 

[leventhal]

Thanks once again. I contacted an attorney specialized on these matters and she pointed out the following:

(1). The forensic image was taken using Encase (a well known software for collecting forensic images): this information is provided by the local forensic company to my attorney.

(2). Recent research http://researchrepository.murdoch.edu.au/24962/ revealed the following:
“…it has been found that both the forensic image and the metadata associated with that image can be freely altered using simple file editors and open source software. Exploiting these weaknesses within the Encase Evidence File format results in a forensic container that can be altered but fails to provide any evidence that this has occurred….”

The local forensic company never gave me any other details (such as hash) of the forensic image except the fact that the image was collected using Encase.

Now, we have a strong argument to question the integrity of the forensic image which could be easily modified without leaving any evidence behind. My attorney stated that keeping the image this long without sending it to NY itself is enough to raise enough suspicion about the intention/professionalism of the local company.

Any comments on this matter are welcome.

 

[quincy]

Thanks once again. I contacted an attorney specialized on these matters and she pointed out the following:

(1). The forensic image was taken using Encase (a well known software for collecting forensic images): this information is provided by the local forensic company to my attorney.

(2). Recent research http://researchrepository.murdoch.edu.au/24962/ revealed the following:
��it has been found that both the forensic image and the metadata associated with that image can be freely altered using simple file editors and open source software. Exploiting these weaknesses within the Encase Evidence File format results in a forensic container that can be altered but fails to provide any evidence that this has occurred�.�

The local forensic company never gave me any other details (such as hash) of the forensic image except the fact that the image was collected using Encase.

Now, we have a strong argument to question the integrity of the forensic image which could be easily modified without leaving any evidence behind. My attorney stated that keeping the image this long without sending it to NY itself is enough to raise enough suspicion about the intention/professionalism of the local company.

Any comments on this matter are welcome.

I am happy to hear you have an attorney working with you now. She will do what she can to present arguments to either keep the computer evidence from being admitted or to discount the validity, the authenticity, the reliability of whatever forensic computer data the plaintiff is allowed to introduce. EnCase has been used in court cases successfully but there are vulnerabilities in any evidence to be used in a case that need to be explored and perhaps capitalized on.

Although I don't want to discourage you, computer evidence that has been forensically examined by an expert is very hard to defend against. Defense attorneys will usually try instead, at the very beginning of a case, to keep a computer from being examined at all. That is generally where the most hope lies.

I still think it might be better to concentrate on a defense to what you wrote rather than to try to fight the evidence the plaintiff might have that you wrote it. But, you need to rely on the advice and direction of your attorney. She has had (I hope) the opportunity to personally review all of the facts of your case and she will know what defense(s) will best work for you in the action filed against you.

Good luck, leventhal.

 

[CdwJava]

Arguing that the data was altered will be difficult without having either proof of the alteration, or, at least a motive for a disinterested third party to alter the evidence. While evidence CAN be altered, the burden would be upon you to prove it.

 

[leventhal]

Many thanks Quincy once again to you for your valuable advice. I understand you message.

To CdwJava and to Quincy: recently I realized that I knew the key employee of that local forensic company and we both had a very bitter dispute (not related to this forensic image) in the past and this is my main concern that the possible alteration of the image (that key person my put something in the forensic image just to harass me). I am sorry for not including this mater earlier, which I thought was unnecessary at that time. I would also like to remind you that the local forensic company failed to follow the court given deadline and still did not submit the image to NY; and took U-turns in the past.

 

[CdwJava]

Failing to meet a deadline is not the same as failing to meet industry standards for their work. You'd still have to show more than a dispute with their records or customer service folks to show that the company would have the desire to commit fraud and risk losing not only business, but some serious fines and the loss of business as a result of such a thing.

I'd recommend you avoid claiming they altered something unless you have PROOF that they did so. Speculation as to a putative motive of spite is not going to get you anywhere. Even a personal beef with a member of the company is not going to get you anywhere.

I'm curious ... are you floating this because you believe that forensic analysis will find evidence that will hang you, so you are floating this as a trial balloon? Or, do you TRULY believe that the forensic company and the employee you have a beef with will somehow know what the issue in court might be and will feloniously plant evidence against you? Or, as is more likely, you just bring this up as a point of curiosity and not out of any real concern?

 

[I'mTheFather]

I'd recommend you avoid claiming they altered something unless you have PROOF that they did so. Speculation as to a putative motive of spite is not going to get you anywhere.

Except maybe back to court for another defamation lawsuit.

 

[leventhal]

Thank you. I have mentioned my reasons that look reasonable for me to believe that the forensic image is altered. Once I rise my suspicions, I think there is a burden of proof (that the image is not altered) on the local forensic company as well because (i). it failed to meet the court given deadlines by several months (ii). there are weaknesses in Encase and (iii). I have dispute with the person who really collected the forensic image from my computer (iv). I have no chance to look at a copy of that image. (v). the local company lied in the past that I never submitted the computer: the forensic image is in the lier’s hand.

Finally, my computer has no incriminating evidence in it but my goal is to stop this forensic image to be used as a witness so that the plaintiff reaches a dead end.