The stories are true; the names and places have been changed to protect the potentially guilty.

It was a cold and rainy San Francisco afternoon. I sat sweating in the conference room of a gritty skyscraper downtown. The deposing lawyer across from me was standing up, leaning across the table, pointing her finger in my face and yelling, “Do you find this funny Mr. Burgess? Do you always let your clients write your reports for you?” I began to panic…

But I’m getting ahead of myself – that’s not where the story started.

It was a spring day in Marin, the kind of day that makes it hard to be hard-bitten. The kind of day when a man trades in his gumshoes for some flip-flops. Little did I know that my own personal raincloud was about to walk in the door. Tommy. Tall Tommy Clanahan. He came in with a victim’s story, but he had a sneer and a swagger that made a person want to stand back a yard or two. As he sat down, my office didn’t seem quite big enough.

Tommy spun a tale that might have sounded far-fetched for a guy of his makeup. I’ve heard many a story that didn’t seem to hold water, but later discovered a whole tub full. I like to think of myself as open-minded. Some might say cautiously gullible. So I listened. Tommy worked in the San Francisco office of a San Francisco-based international manufacturing company – a big one, with very deep pockets. Let’s call them Salome Jacobs. The company was known for its commitment to workers’ rights and its sensitivity to political issues. Tommy was being let go and he believed it was not for cause – sexual harassment was the reason. Tommy felt that he was being fired for spurning the advances of his immediate boss. She had come on to him, he said, and he wasn’t interested. Now she was out to punish Tom, to show him she didn’t take rejection from an underling lying down.

But that wasn’t all. His roommate was spying on him. Tommy was certain that the roomie, another employee of Salome Jacobs, not only took unauthorized looks into Tom’s computer while Tom was away on vacation, but had been remotely monitoring it, stealing files, and passing them on to Salome Jacobs for ammunition. It happens.

Tom signed my contract and dropped off two old Macintoshes with his deposit. Into the lab they went. First step, identical copies of the hard drives. These were SCSI drives on a Mac so I used the handy FWB Toolkit of the day to make blind block copies. The relevant tasks included:

• Cataloguing all computer access during Tom’s vacation.
• Finding any evidence of remote access to the computer.
• Any evidence pointing to the roommate’s name or contacts.
• Performing keyword searches and extracting text from the results.
• Finding and producing active and deleted printer and fax logs.

Initially, little obvious supportive evidence showed itself, despite Tom’s urging me to reinterpret what I had found. But I did have a large body of files, file fragments, fax records, logs, and results of keyword searches to deliver to Tom and his attorney for perusal. It might be that by sifting through this large cache of info, something useful might be dug up.

A couple of months later Tall Tom once again graced my door, with a triumphant cast to his posture. “We’ve found the evidence!” he announced as dropped a stack of printouts on my desk. “There!”

I congratulated him and asked him to point out the good news in the stacks. We began to work through them together, his excitement expressed in every movement, every highlighted clause, every turning of a page. And a potential story began to come together. At times though, there can be a problem with potential stories. Because, as the saying goes, when you’re a hammer everything looks (potentially) like a nail. The story just didn’t come together in a way that I could testify to. Evidently his attorney thought so too because Tom fired him.

Lawyer number two contacted me the following month. He opined as to that the narrative discussed a month before was surely a possibility. And it was. I took the relevant data points to which I’d been directed and wrote a new report, incorporating the new information. Someone had used the fax during the time that Tom said he was gone. Someone had visited party, sex & drug sites in the same time frame. Somebody had started to draft a letter to an attorney that wasn’t Tom’s. It looked like somebody did a “Find” from within Microsoft Word and also from the Finder for a name not associated with Tom’s own inner circle. I noted a few possible explanations for the existence of these data points. It was solid. I like solid. I sent the new report to Tom and his lawyer.

Tom had also sent me some printouts of screen shots he had taken, showing when the fax program had been used. He wanted to present them in court, as a part of his case. I suggested that he move the windows around on his screen before taking the screenshot so folders with colorful names – names with more picturesque versions of phrases like “algae eater,” “offal pate” or “parent lover” – would not be showing. Tom replied with a whole new report, about twice as long as mine, stating that specific people with certain motives at various times were doing particular things that could have happened. It was another hammer and nail thing. They could have happened. But where I reported shadows, he talked of assailants. Where I wrote about hints of searches, he had full-blown scenarios and motives. Where I mentioned possibilities, he asserted scientific fact.

I annotated Tom’s version and copied it to him and to his lawyer, explaining why I couldn’t say these things. Tom replied with a new report that looked very much like mine, but I told him I already had a signed copy for him of what I had written, sent one to him and one to his lawyer. I offered that he could come and get the original.

Tom was in my office within the hour. Needless to say, my report’s language wasn’t as strong as the language he would have preferred. Nor was it as strong as the language he directed across my desk at me. Colorful dialogue aside, the key phrase bellowed was, “Who’s paying you?!!”

“You are, Tom. But you’re paying me to tell the truth. You’re paying me to find the facts. You’re paying me to offer an opinion based on my best understanding of the facts. Your understanding of the facts may reflect the reality of the situation, but I can’t verify or validate your interpretation. I can’t speak to who was sitting at your computer when you were ostensibly away, and I can’t speak to anyone’s motives.”

And just like that, I wasn’t being paid. I was off the case, left holding a bill for work I had been asked to do and had done, the outcome of which the client didn’t like. That was an expensive little soliloquy. More than three years passed. Life went on.

I got a phone call. It was Tom’s new lawyers (the 4th set), Philo & Franco. They asked me if I remembered my old friend Tom. “Yes,” I said, “I always remember people who owe me money.” They asked if I still had his data. I asked if they were hiring me. They told me to expect a subpoena from opposing counsel for my data file on Mr. Clanahan. I asked why, as an expert, I was being subpoenaed and not paid for my work, and they replied that they didn’t know – it was all about opposing counsel.

Sure enough, a week later I received a subpoena from a San Francisco firm for the electronic records. I had already made a disk with the Callahan folder, and I sent it off to them. Another couple of months, and I received another subpoena, this time for my personal presence. Nobody had hired me.

I thought it time to give Philo & Franco a call. I told them I’d been ordered to attend a deposition regarding their client, Tommy Clanahan. Was I to attend as somebody’s representative? Translation: are you paying me to represent you or am I going as a percipient witness?

Their odd reply was along the lines of, “If you do well, we’ll consider hiring you.” Seemed that I was going as a percipient witness after all. The significance of this is that a percipient witness is just a fancy name for an eyewitness, not an expert. So, as a non-expert for the purpose of the proceedings, I had no opinions to offer – I could only report on what I had seen.

I showed up on time on the aforementioned rainy San Francisco afternoon, grimy skyscraper. A winter flu was fast creeping up on me. The deposing attorney started in on trying to take apart my qualifications. I had a query of my own. “I don’t understand why you are asking me about my background. I’m not offering an expert opinion today; I’m only here as a percipient witness.”

“Are you refusing to answer my questions, Mr. Burgess?”

“No, but I don’t understand the relevance of them.”

The questioning went on for a while, with a couple of iterations of the above exchange. Finally, Philo (Franco was back in the partners’ office) said, “We’ll pay you for your expert opinion when she asks you a question that requires it.”

“I’m sorry, but I’m either here as an expert or I am not. As I have not been hired by your firm, I have no opinions to offer, and the questions I’m being asked about my background are irrelevant.”

Several frantic phone exchanges between the partners later, it was decided that I would after all, be there as their representative. Wasting no time, the deposing attorney, Ms. M pushed a document at me and asked me to read it. It was delicately written and had phrases like, “I will break your [expletive deleted] arms, you [e.d.] relative of a [e.d.] goat-[e.d.], and feed them to a [e.d.]…” That kind of thing. It was so outrageous, so like Eddie Murphy at his most foul-mouthed, that I let a snort escape.

Oh no. I knew I had made a mistake.

“Let the record show that Mr. Burgess laughed upon reading this document, which we will include as Exhibit D. Do you find this kind of threat funny, MR. BURGESS?!” Wow. Yelling, dramatic pose, finger wagging in my face and everything. And the words on the record.

“I did not realize that it was a threat, Ma’am. It struck me as something a blue comic might utter.”

“Haven’t you seen this before? Did you know that your client wrote this?”

Strangely enough, I had not and I did not. Although Mr. Clanahan and at least two or three of his attorneys had apparently seen this in the pile of data I had sent them for review, no one had brought it to my attention before. I replied, “Mr. Clanahan is not my client; Mr. Philo here is.”

“What do you think of a person who had written something like this?”

“Ma’am, I’m not an expert on psychology or personality types, but I would hope that person was not serious.”

Shortly after this exchange, I asked for a break to go to the john. I invited Philo along with me. I asked him, “Do you really think it serves your client to let her lambaste me, poke a digit in my face, and the like? Wouldn’t it be a better idea if you got an objection or two to this kind of hostile behavior on the record?”

“I guess.” Seems Tom engendered a lot of affection in the people he hired.

As the afternoon wore on, and the burgeoning flu began to wear me out, Ms. M had another surprise for me. “Mr. Burgess, I’d like you to read this and tell me what you think.” I looked down and began reading a copy of my report that she’d given me. Something seemed wrong. I seemed to be making unsupportable assertions. I wondered, could I have been this bad a few years ago? I did not understand how I could have written this. I needed time to think, but I found myself shaky and sweating.

“I think my head cold has gotten the better of me, Ms. M. Could we continue this tomorrow?” This statement was punctuated with a genuine sneeze and request for tissues. The deposition was begrudgingly continued to the next day.

I made a beeline for my office. Digging through the records I hadn’t looked at in nearly four years, I discovered a document I had never seen before. Tommy had taken my report and inserted numerous lines he’d wanted added. Perhaps he hoped I would overlook them and sign the report, but I’d never read it before. This was the document that Ms. M had pushed across the desk at me.

I also saw other documents I’d never read before: they included notes about working with an attorney to skimp as much as possible on funds to a former spouse, work as a former prison guard and before that as an enthusiastic soldier-for-hire. There was the characterization of his former employer’s progressive relationship with its employees as communist or liberal sympathizers, flower children who wanted to destroy conservatives and America. There was mention of the things he’d like to do to those who disagreed with him, or the former friends who might “side with the enemy.” There was mention of the dirt he would dig up on the company and make public. There were many very unflattering characterizations of his former coworkers, and strong hints of blackmail, and a way to make the company cough up three million dollars. These all added to my image of the man as a less than sympathetic character, and perhaps explained the five attorneys.

The following day, feeling a bit healthier, I showed up on time in my fancy duds and asked to make a statement on the record at the beginning of the day’s deposition. I explained that the document I had been shown at the end of the previous day was not one I had written. I asked if there was a signed copy of it and of course, there was not. I was asked how it got in my file, and I explained that apparently Mr. Clanahan had sent it for me to use.

“Do you always let your clients write your reports for you?” Now I was able to explain that, in fact, no one had written a report for me, but rather that Mr. Clanahan had sent me an altered version of my actual report, perhaps hoping for a more sympathetic treatment. After that, there wasn’t much left of the deposition.

I did get called into San Francisco Superior Court to testify before a jury on the case. I arrived in my freshly pressed livery and Ms. M called me to the stand. She had one document and one question for me. She pushed the “Eddie Murphy” letter at me and asked me to read it. Presumably, she wished for the jury to see my indelicate snort.

“Have you seen this document before Mr. Burgess? May I ask you when?” And that was it – no laugh, giggle, snort or titter, and my testimony lost its value for her. I was excused.

Before you ask, yes I did need to have my attorney send Philo & Franco a letter before they paid me. And no, I didn’t stick around for the verdict, but I have a feeling that Tommy is not three million dollars richer.

As for me, I’m looking to make another computer to give up its secrets, finding another report to write. There’s forensic work to get done and just maybe some time to break out the flip-flops again.

This is just one of the many “CSI* – Computer Forensics Files: Real Cases from Burgess Forensics”. Stay tuned for more stories of deceit uncovered by computer forensics. Copyright 2010, Steve Burgess

Subscribe to our free and informative weekly forensics newsletter!