“It’s encrypted, so I guess we’re just out of luck.” I hear some version of that from attorneys and other clients more often than you’d think, usually said with a kind of resigned finality, as though the phone in evidence had sealed itself inside a block of concrete. Sometimes it’s true (well, not the part about the concrete). More often, it isn’t — and treating encryption as the end of the inquiry leaves evidence on the table that the other side may be perfectly happy to collect.

Here’s the thing worth understanding: encryption locks the front door. It rarely locks the windows, the copies, and the spare key under the mat.

Modern devices encrypt data at rest. When an iPhone or a current Android phone or a laptop running FileVault or BitLocker is powered off or locked, the data on it is scrambled and, without the key, is effectively unreadable. That part is real, and it’s strong – it’s real strong. But “the data on that specific device, while it is locked” is a much narrower thing than “the information you’re after,” and the gap between those two is where most access actually happens.

The passcode is the whole ballgame — and people are careless with it. Full-disk encryption is only as strong as the credential protecting it. People reuse passwords, write them on sticky notes, store them in a notes app, share them with a spouse or an assistant, or pick something guessable. When access to a device is lawfully available — through consent, a cooperating party, or a court order — the encryption stops being an obstacle the moment the passcode is in hand.

And by the way, the data usually lives in more than one place. This is the point often missed. A message exists on the sender’s phone and the recipient’s. When the message’ sender deleted it from their phone, it doesn’t do anything to the recipient’s copy of the message. Photos sync to iCloud or Google Photos. Documents sync to cloud storage. Phones back up to a computer or to the cloud, sometimes automatically, sometimes in a form far easier to access than the locked handset itself. The encrypted device in the evidence bag may be the hardest copy of the data to reach — and the least necessary, once you map where else that same information lives.

Cloud accounts are their own doorway. When the data has synced to a provider, the relevant credential may be an account password rather than a device passcode, and the legal path may be a subpoena or warrant to the provider rather than an attempt on the hardware. Different lock, different key, often a more productive one.

The law here is genuinely unsettled, and that’s your department, not mine. Whether a person can be compelled to disclose or enter a passcode touches the Fifth Amendment, and courts around the country have landed in different places on it — some applying a “foregone conclusion” rationale, others declining to. Compelled use of a fingerprint or face has its own tangled line of cases. I’m a forensic examiner, not a lawyer, and I won’t pretend the doctrine is settled when it plainly isn’t. But knowing that these avenues exist — and that they’re contested — is the difference between assuming a device is unreachable and asking the right questions about how it might lawfully be reached.

So what should you actually do? Stop treating “it’s encrypted” as the end of the road, as a verdict. Treat it as one locked door in a building with several entrances. Ask where else the data lives — the other party’s device, the cloud, a backup, a synced computer. Preserve all of it early, before someone decides to tidy up. And bring in a forensic examiner before you conclude anything is impossible, because what’s feasible depends heavily on the specific device, the operating system version, and how the data was stored — details that change constantly and that a competent examiner tracks for a living.

Encryption is a strong lock. It is not a force field. The attorneys who understand the difference get to the evidence; the ones who don’t talk themselves out of it.

Have you ever had a case when a locked or encrypted device in your case was or was not actually a dead end? I’d love to hear about it.

Don’t miss a single issue of our informative newsletter … Subscribe now

The post Encrypted Doesn’t Mean Untouchable: What Attorneys Should Know About Device Access appeared first on Burgess Forensics.

You thought you sent a one-page letter. What you actually sent was a one-page letter and a small pile of paperwork the letter filled out about itself when you weren’t looking.

That paperwork is metadata — data about data. And it travels with your files whether or not you invited it along for the trip.

Metadata is the stuff a document quietly jots down while you’re jotting down words. There’s a lot of potential information there: Who created it, when, and on what computer. Who edited it, and when they last saved it. Where a photo was taken, down to the GPS coordinates. What camera, what settings, what software. None of it shows up on the page. All of it comes along, like a stowaway.

Most of the time this is harmless, but occasionally, it’s the whole story.

A photo is a very talkative little file.

Take a picture with your phone and you’ve created a small autobiography. The image, surely, but tucked inside is a section called EXIF data: the make and model of the phone, the date and time down to the second, and, if location services were on, the exact spot on Earth where you stood. Share that photo in its original form and you may be handing over your home address without meaning to.

The good news: most social platforms started stripping this out a few years ago when there was a public hue and cry about it. The bad news: “most” is not “all,” and emailing the original file, or dropping it in a shared folder, sends the whole talkative package along.

Documents keep a diary too

A Word document remembers more than the final draft. Depending on your settings, it can carry the author’s name, the company the software was registered to, how long the file was open, and sometimes, a list of former edits and tracked changes and comments you thought you’d removed. Every “on second thought, delete that paragraph” can live on in the file’s memory.

The Internet is dotted with cautionary tales of press releases and legal filings that were sent out with the edits still readable underneath. The same is true with newsworthy congressional hearings. Most of us are not popular enough to warrant interest from the government. Still, the words on the page said one thing but the metadata said “here’s what we almost admitted.” Oopsie.

So, what to do?

There’s no need to get paranoid about this. Depending on what you’re shopping for, your grocery list is not a national secret. But a few practical habits go a long way:

• Before sending anything sensitive, look under the hood. In Word on Windows, “Inspect Document” should find and remove hidden data, comments, and tracked changes. Do it on the final version, not the draft.
• Turn off location tagging for your camera if you don’t need it — or scrub EXIF data from photos before sharing the originals. By the way, if litigation is foreseen that involves these photos, don’t scrub the EXIF metadata. It will be considered spoliation of data and will go poorly for you if and when it goes to court.
• Remember that “delete” inside a file often just means “hide.” Removing a comment from view is not always the same as removing it from the file.

None of this requires becoming a hermit. It’s the digital equivalent of checking your pockets before you send the coat to the cleaners.

Metadata isn’t sinister. It’s just honest — sometimes more honest than we’d like. The trick is knowing it’s there, so you decide what to share instead of the file deciding for you.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post The Metadata You Didn’t Know You Were Sending appeared first on Burgess Forensics.

The format language in a discovery request is easy to skip over. It looks like boilerplate. It reads like boilerplate. It is actually boilerplate. And so it gets waved through: “produce as PDF, that’s fine.” Maybe not so fine when that same attorney later pays me to explain why the file on my screen can’t answer the question the case now turns on.

Here’s the thing the other side already knows: whoever picks the format picks what you get to see. It’s just how the rules work. Under Federal Rule of Civil Procedure 34(b)(2)(E), the party asking for the documents gets to specify the form they arrive in. Don’t specify, and the choice falls to the producing side, with “reasonably usable” form as the only floor — and reasonably usable is a long way from native. Say nothing about format and you’ve handed them the pen.

Native files vs. PDFs sounds like an argument for the IT department, right? It isn’t. It’s one of the quietest, most consequential fights in the whole discovery process, and it’s worth having on purpose.

A PDF is a photograph of a document, not the document

A native file is the thing itself – the spreadsheet with its formulas still doing math, the email with its full routing header, the Word file that still remembers every draft, the photo that quietly wrote down where and when it was taken. I have a paragraph in my engagement letter saying so, albeit a bit more succinctly. A PDF or a TIFF is a picture of that file after someone chose the pose.

What really gets me is when evidence is produced as a printout of a PDF of a scan of a PDF created from the actual original file. Happens all the time. But it’s several steps away from what really happened and far from the metadata that tells the real story.

Such “pictures” drop exactly the parts that tend to win cases. Most of the metadata, describing fields such as who made it, when, on what device, and sometimes where tends to get lost when a PDF is generated from it. This is the difference between “he says he wrote it in March” and knowing, to the minute, that he didn’t.

A spreadsheet may show you a very precise value of 4,203,722.46 in the flattened PDF version but hides the formulae and structure that generated a possibly different number. A document that previously contained all the things people put in a document before they remembered other people would read the tracked changes, comments, hidden rows? Native format keeps them. The flattened copy forgets them, conveniently.

Hash values and container data are integrity signals that may let you and me confirm that the document produced is the same as the original are casualties of a PDF export. It snaps that verification thread and asks you to just take everybody’s word for it instead.

None of it comes back, either. You can’t un-flatten a PDF into the original any more than you can un-fry a flapjack. Once it’s produced that way, the missing data isn’t hiding from you. It’s gone.

I had a case where the “date digitized” EXIF metadata from a series of photos supported one side’s story. However, deeper in the metadata, there was satellite data that cast real doubt on the story being told. Satellites and their atomic clocks don’t lie about the time or the day.

Why the other side is so agreeable about it

Producing in PDF usually isn’t laziness. It’s control wearing the costume of laziness. A flattened production is easier to redact, easier to Bates-stamp, and, in a happy coincidence, easier to sanitize. The timestamp that wrecks the timeline, the author who wasn’t supposed to be within a mile of that memo, the formula that shows how a number really got built: all of it vanishes in the conversion, and it vanishes wearing the respectable coat of “routine document handling” rather than the orange jumpsuit of spoliation.

To be fair, imaged production isn’t always a dodge. Sometimes there are honest reasons for it — privilege review, redacting personal or protected information, or real proportionality under Rule 26(b)(1) when native would cost more than the whole dispute is worth. Those reasons are legitimate. The trick is to make the other side say so out loud, in the protocol, so that “we imaged it” has to be justified rather than simply assumed.

I should be clear that “save as PDF” is also a genuinely lousy way to strip metadata even when someone’s trying to be honest. It leaves things behind and takes things it shouldn’t. But that’s a different article. For today: the party that controls the format controls the evidence, and they know it even if your side doesn’t.

The fight is won in the ESI protocol, not in a motion six months later.

This is the part I most want attorneys to hear. By the time you’re standing in front of a judge complaining about a bad production, you’re asking to redo work the other side has every incentive to slow-walk into the next fiscal year — and you’re explaining to your client why the schedule, and the bill, went sideways. Nobody enjoys that conversation. Least of all the person who once said “PDF is fine.”

So specify the format on the front end, in writing:

• Ask for native formats, with metadata, by default for anything data-rich — spreadsheets, databases, structured exports — with load files that actually carry the field data. Boring to negotiate. Priceless to have.
• Name the metadata fields you want. Custodian, author, created and modified dates, an MD5 or SHA-1 hash, and parent/child relationships so attachments stay tied to their emails. “With metadata” is an invitation for the other side to read the phrase as generously as their conscience allows.
• Reserve the right to request native format for anything produced as an image, and say so up front — so when you invoke it, it’s a term of the deal and not an ambush they get to act wounded about.
• Bring your examiner in before the language is set, not after the production disappoints. Format specs written without technical input have a real talent for asking, very precisely, for the wrong thing.

The bottom line

This is not enhance-the-reflection-in-the-sunglasses forensics. It’s plumbing. It’s unglamorous, it’s easy to skip, and it is very often the only thing standing between evidence you can build a case on and a tidy picture of evidence you have to take on faith.

Courts increasingly expect native production where format carries meaning, and (hopefully) increasingly treat “well, we already gave you a PDF” as the weak answer it is. But you don’t drift there by luck. You get there by treating format as a substantive term of the case — argued with the same seriousness as scope and custodians, and about a thousand times more attention than it usually gets.

Have the fight early. It’s a great deal cheaper than the one you’ll have later, in front of a judge, with your client and their checkbook watching.

What’s the worst production-format surprise you’ve run into — native you wish you’d demanded, a PDF that turned out to be hiding the whole case, or something else entirely?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post Native Files vs. PDFs: Why Discovery Format Fights Are Worth Having appeared first on Burgess Forensics.

A fitness tracker once told me the exact moment its wearer stopped moving. Not slowed down. Stopped. The device wasn’t built to establish a time of death. It was builtto count steps and nag its owner about standing up more often. But it kept a continuous record, and that record answered a question nobody had thought to ask it.

I can’t reveal much about the case. The survivors believed the facility had let conditions get too hot for too long with too little warning. The other side believed close to the opposite: that the tracker’s own history showed the deceased knew better than to push that hard through a changing but controlled environment. Both sides were arguing about the same person’s habits, and the tracker had a record of them. Dueling cardiologists reached differing conclusions about the fitness level of the deceased.

I did not expect a line chart to affect me. Heart rate climbing to a dangerous peak, dropping to zero, then flat and never moving again. Plain as any spreadsheet. Then I imagined what that jagged line meant on the floor of the event.

That case is the whole of digital forensics in one artifact. People imagine this work is about clever adversaries planting evidence. I hear that concern regularly, and it is rarely what actually happened. The real story is duller and much harder to argue with: an ordinary device did exactly what it was built to do, and nobody remembered that what it was built to do includes keeping a record.

Your house is full of these. A video doorbell logs every motion event with a timestamp, whether or not itsaved any video.A voice assistant logs when it woke up, and sometimes what it heard in the few seconds on either side, depending on a setting its owner has never opened or knew existed. A thermostat infers occupancy from temperature adjustments and motion, which turns out to be a decent proxy for whether anyone was home. A robot vacuum holds a floor plan of every room it has ever cleaned. A car knows where it went and how fast it got there. It is getting harder and harder to have a good ol’ dumb home.

None of this was designed to be evidence, which is one reason it can become powerful evidence when properly authenticated and interpreted. There may still be questions about reliability, chain of custody, retention settings, incomplete logs, and similar issues, but the device itself has no made-up story to keep straight. It is not shaped by human memory in the way witness recollection is, though it still has to be interpreted carefully. Someone can be careful about what they say out loud and still be wearing a watch that logged a heart rate spike at the moment in question.

The law is still catching up. Carpenter v. United States narrowed the old assumption that anything you hand to a company is fair game without a warrant, at least for cell site location records. Aside from preservation duties, discovery scope, and the need to meet and confer, there is a live question whether that reasoning will narrow access to data from a thermostat, a vacuum’s floor map, or a year of refrigerator door-open events. Those boundaries are being worked out one motion and one court at a time as we speak. I would not bet on the answers looking the same in five years as they do today.

For lawyers, the lesson is simple: ask early what connected devices were present, where the data is stored, how long it is retained, and who controls it.

In the meantime, the practical reality is simpler. Your home has more employees than you think, and all of them are taking notes. None of it is malicious. Much of it may be discoverable or obtainable, if someone thinks to ask.

What smart-device data point has surprised you most, in a case or in your own house? I’d love to hear about it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Your Smart Home Is Testifying Against You appeared first on Burgess Forensics.

Printers and Copiers Left Out of the FBI’s Search of Trump’s Mar-A-Lago

copyright, 2022, Steve Burgess

We’ve only recently learned the content of the search warrant that the FBI used to search the premises of former president Donald Trump’s Mar-A-Lago resort and residence. It seems they overlooked some potential information.

Printers have data storage

It’s not commonly known but many printers, copiers, and multifunction devices that combine the functions of printer, scanner, and fax contain internal storage. Some have hard drives and some have solid state memory. Your computer sends a whole print job (or several) to the printer so that the computer’s bandwidth doesn’t get choked by waiting for the printer and computer to talk back and forth. It could be hundreds of pages. It includes dates, times, and titles. It often contains email addresses and even complete documents.

These devices can hold a couple hundred thousand pages of documents. Yes, I said 200,000 pages.

Two Hundred Thousand

In a networked environment, such as at many offices, hotels, or resorts such as Mar-A-Lago, several computers send such print jobs to the same printer. So the printer needs a lot of storage and computing power to feed and print those jobs in the right order.

Some printers delete the data when the printer is turned off – but who turns off their printer? And even so, as a long-time digital forensic expert, this author can tell you that deleted data is not destroyed data. Especially with hard drives, that data can persist for years, until some other process overwrites it.

People Leave Data Behind on Their Printers and Copiers

There’s a well-known case where a CBS investigation showed that a reseller of used printers found tens of thousands of documents on four printers they’d purchased in one day. The documents found included architectural plans for a building to be raised on Ground Zero, copies of checks and check stubs, 300 pages of personal medical records from a health plan’s machine, and much more sensitive information.

This same investigation noted that used and decommissioned printers go to numerous other countries for resale. As if these documents weren’t dangerous enough when left in American hands…

But surely, an ex-president would have adequate hired expertise and security so as not to have such data laying around on its devices. Maybe not.

Mar-A-Lago has Been Lacking in Security

There have been numerous incidents where foreign nationals, some posing with fake identities, have walked right past the resort’s security. In one case, a Chinese national was allowed onto the grounds carrying four cell phones, two passports, and a flash drive infected with malicious malware. She said she was heading for the pool. Fortunately, she was eventually caught, hopefully before making use of the many devices at her disposal.

A large percentage of printers don’t need physical connections, such as Ethernet cables, but rather have wi-fi access to the local network.

Poliphilo, CC0, via Wikimedia Commons

A few years ago, during an investigation of digital security by ProPublica and Gizmodo, they parked a motorboat 800 feet away from Mar-A-Lago’s back lawn and quickly detected three wif-fi networks with weak encryption. They said they could have hacked the networks in five minutes – but they didn’t.

So, why is the above problematic?

The aforementioned flash drive could have been inserted into a computer or printer at the club to disrupt, corrupt, or steal data. After all, Iran’s nuclear program was disrupted by Stuxnet, which was loaded from a flash drive that had been left lying around Iran’s Natanz nuclear research facility.

Network access by a bad actor might also steal data from devices or networks at Mar-A-Lago.

Now to the FBI’s search of the resort’s residence.

The seven-page search warrant partially relied on The Espionage Act, 18 U.S. Code § 793 – Gathering, transmitting or losing defense information, which deals with the possession or copying of documents and materials related to national security, particularly information that could be used to harm the U.S. or benefit a foreign country…

While the search warrant specifies “All physical documents and records constitutes evidence…” and containers thereof, it goes on to talk about what seems to specifically be paper documents.

The digital data we’ve been talking about are likely to contain documents and of course, in doing so, are containers themselves. But digital evidence is not mentioned in the warrant, at least insofar as the news reports we have seen thus far, and as far as the actual text of the search warrant states. 

It has been reported – and shown in photographs – that the FBI found dozens of empty folders with markings indicating that they had held classified and top-secret documents.

Why would those folders have been empty? Well, of course, because the documents that they had previously held had been removed.

And why would the documents have been removed from the folders? One reasonable inference is that they had been removed to be copied, and not put back.

The FBI found dozens of documents categorized as stolen by the very act of taking them from the White House. There were many  classified documents among them and clearly, not all of them have been returned. A further search might reveal that some of them had been copied and/or stored digitally.

Isn’t this something that ought to have been contained in the search warrant?

In the many cases where your author has been retained as an expert, law enforcement typically grabs everything that would seem to store data – computers, hard drives, flash drives, cameras, SD cards and more. They may triage some or all of these devices on-site so as to take only the ones that contain suspect data. But I don’t recall ever having seen a property list of seized devices that includes printers or copiers.

Maybe it’s time for these devices to be included in the average seizure of suspect equipment. But when it comes to national secrets and the compromise of our intelligence agents, domestic and overseas, it would seem to be essential.

TIP: If you sell your printer or copier, make sure you find the manufacturer’s instructions on how to wipe the data it contains. The same holds true if you recycle it, or even if you toss it in the trash. (Be aware that there are many electronic recycling centers that can keep this potentially toxic trash out of the landfill.)

The post Printers and Copiers Left Out the FBI’s Search of Trump’s Mar-A-Lago appeared first on Burgess Forensics.

Not everything always works out in Forensicland. Sometimes we strike out. In more ways than one.

I was gazing out the tall windows of my office at the blue, blue Santa Barbara sky, with nary a cloud in sight. It was my 50-something birthday. The bills were ignored. It seemed like a perfect day.

Then the phone rang and a delightful voice answered. Ginger Justín. She laughed; she loved my jokes; she thought I was brilliant. She said I was perfect for her. As an expert. I reminded her of her dad. Her deceased dad. I should have taken the cue.

It seems that Ms. Justín’s dad had passed away – possibly with the help of Lynn Dallas, live-in companion – a companion who was in the latest version of dad’s will. Not only that, Ginger – kind, caring, lovely Ginger – had been written out of the will. Her siblings were still in there. The grandkids were still in there. Ms. Dallas’s companion animal was in there, for dog’s sake! Money for the companion’s companion! But nothing for Ginger.

Something had to be done. The poseur had to be exposed before she took yet another old man’s fortune. As Ginger informed me, this was Dallas’s M.O. Get to know the old guy, move in with him, become a love interest (“She never loved him; she was just after his money!”), then help him shuffle off the planet when the time was right. Ginger’s legal eagle, Big Dan Tuberosa, concurred. “This is a bad woman, this Dallas. She must be stopped.”

So I asked for a catalog of devices that might hold various versions of the will. Mr. Justín had quite a setup. Racks with networking gear upstairs and down. Several computers and laptops. Lots of backup hard drives. Ginger asked if I could pick them up at estate administrator, John Geering’s place in Silicon Valley. And if I could cut this poor heroine break on the price.

Thirty years of being in the biz has taught me the hard way that when someone tries to wheel & deal with you, it’s a red flag. Every dollar discount seems to come with a five-spot decrease in respect. It’s an odd part of human nature that giving away a C-note makes people think you’re an easy mark. But her desperate charm kicked in and I said I’d pick the gear up next time I was up that way. It turned out that Yahoo! News wanted my input for an online interview/article called: “True/False: Never Sell Your Old Phone,” so after the interview, I went to Geering’s nearby digs to fetch the stuff.

When I came downstairs from his office, there was Ginger, waiting to greet me. She was long, lank, and lean, except where it counted. Her flaming red hair was alight with the afternoon sun. She leaned up against me with a languid, lasting hug and asked me to share a beer at a local sidewalk café, where we could discuss the case.

I picked a table outside, in everyone’s view, just to play it safe. A local Firehouse IPA cooled my flushed face and settled my nerves enough to unaddle my wits. The roar in my ears subsided. I heard more about how much Ginger’s dad loved her. I heard more about how her siblings (the ones still mentioned in the Will) were relying on her to get the real story out, in their father’s memory. I heard how Ginger had to do this all by herself. I heard more about the evil Miss Dallas. I heard how this case would be worth tons of money and couldn’t I do part of my fee on a contingency basis?

As it turns out, expert witnesses are not allowed to work on a contingency basis. The image of the hired gun would be inevitable. Regardless of the circumstances, being paid by how much you win just doesn’t fit with the ethics of complete honesty on the stand. Like the Lamas teach, attachment to the outcome just causes suffering.

We still had the matter of a contract and a retainer to deal with. Big Dan assured me that Ginger was good for it, but it’s never a good idea to get started without something written down. She signed the contract and cut me a check.

With this behind us and some tech talk put into lay terms, we decided on a strategy.

She thought two computers (with 3 disk drives) would be most likely to bear fruit.

• I would, of course, make a forensic image of each of the hard disks, using FTK Imager through a write blocker.
• Do a keyword search with EnCase for terms and phrases taken from known versions of the Will, and provide the results as a spreadsheet for each search term.
• Recover deleted files.
• Look for Willmaker documents, including by finding a hexadecimal signature for those files, then search and carve them out with Blade.
• Find when and on which computer there had been Wills created, modified and accessed.
• Provide a complete listing via spreadsheet of all files with Creation, Last Written, and Last Accessed Dates, amongst other file attributes.
• Dig up all existing and deleted History entries, using NetAnalysis and HstEx
• Find what USB devices had been attached to each computer (in case there were more discoverable devices).
• Find out if file-wiping software had been installed.

As you might imagine, it took a bit of time and produced a whole lot of electronic documentation. This much data would take out a significant chunk of forest if I sent it as printouts. That many reams of paper aren’t free, and as I wasn’t working pro bono, the time to print it out wouldn’t be free. Facing the reality of having to pay for my time, Big Dan and Ginger agreed to take it as files even though they didn’t want any electronic correspondence to be able to be traced later. They wanted email communication to be mute on the subject of what we found. The CYA alarms inside started buzzing. More flags started going up…

Ginger spent many hours trying to sort through the data. I spent many hours on the phone explaining. She was bright, but her head just wasn’t built for electronic spreadsheets – it was built for storytelling, and she composed a storyline to fit her narrative.

When I explained that the facts didn’t fit, she asked me in a throaty voice if I couldn’t please, please make this one adjustment to what I though the data meant? Through more red flags, I had to assume she was pulling my leg. The data is the data. As a famous TV cop once said, “Just the facts, Ma’am.”

The defendant’s counsel agreed to take my deposition over the phone. When an attorney is getting ready to try to take me apart, I like to be able to read his body language, so phone depos are not my favorites. I could hear Big Dan and Ginger in the room, along with the other lawyer. We got into the subject of what modification, creation and access dates meant. As I explained, I could hear Ginger ask for a break to check on her son, who she said was sick at home.

Then, my office phone rang and the number was hers! Her son was fine. She had called to try to change reality a bit. Though she had trouble finding her way around a spreadsheet, she insisted I was wrong in my testimony about file dates. I had to explain that I did know a thing or two about them, and that I had performed the experiments myself for confirmation. She had as well, she said, and I was wrong. I’ve got to admit, I was a little rattled. I tried to explain that Windows 7 and XP treat certain dates a little differently. I had to stick to my guns, and Ginger was furious.

Still, they decided to take it all the way to court. Ginger prepared a stack of shreddable paper spreadsheets and faxed them to me. Now I was the one having trouble interpreting spreadsheets as I couldn’t make hers hold together. I did my best. No one wants a beautiful woman to think they are being scorned.

Then she faxed me about a 100 points she wanted me to testify to. I spent more hours explaining that there were many things in there that I simply couldn’t say. I felt I was on a debate team. I should have quit then and there, but I stuck with it until she said -in writing – that if I couldn’t answer a particular point a particular way, she insisted that I say I didn’t know the answer. Even if that wouldn’t have been the height of an ethics breach, it would be perjury.

I quit.

I called Big Dan and told him I was taking myself off the case and that he really ought to tell his client not to ask an officer of the court to perjure himself. But Dan was still a believer in this terrible temptress. And court was looming. I let myself be talked into going to court under the following circumstances: Ginger wouldn’t talk to me any more – only lawyer Dan; nobody would try to influence my testimony, including Big Dan; and I had to receive immediate payment to cover the long-overdue bill as well as upcoming testimony.

Done and done. I un-quit. Would that the agreement was kept.

What should have been a few hours on the stand turned into two whole days. Ginger sat with her lawyer, scowling, shaking her head, and otherwise trying to get me to say the “right” things. Every one of her experts and her attorney and the judge was a doofus, and every one of the opposition’s was brilliant. The breaks were full of accusations and this pretty woman who could make so many people dance to her tune just couldn’t get the facts to say what she wanted them to, no matter how many times she changed her mind about what they ought to mean.

They asked me to stay another day as a rebuttal witness to the next guy, but I just couldn’t. I had to deal with reality and appointments.

Well, in the end, I was left holding the bag for a day’s court billing – and karma caught up with the toxic temptress. Maybe it was her histrionics, her fluid way with the truth, or just that Daddy had written her out of her inheritance for some odd reason. But after more years of working the court system, the evil Lynn Dallas ended up with what the Will deeded her and the shifty siren got a share of Karma.

So now I sit, meditating on flags and signs and that blue Santa Barbara sky. Paying a little closer attention to what the universe has to show a guy that makes his living digging up the truth with a forensic spade. Trying to see what’s coming before the almighty has to hit me in the forehead with a sledge hammer to get my attention. And keeping the fancy duds pressed for that next court date with the facts.

The post The Case of the Deadbeat Beauty appeared first on Burgess Forensics.