|
|
 |
Sanderson Forensics were contacted by a firm of solicitors who, at the 11th hour, asked us to review a word processor document to establish its provenance. The salient points of the case were:
The respondent (A) had been accused by the claimant (B) of defrauding him of a large sum of money
A had produced electronic copy of a loan agreement at a very late stage in the proceedings. This purported to have been the initial contract between the two
The contract was said to have been created in 1999
A printed copy of the document had been produced early in the proceedings but B had always claimed that it did not represent the agreement he had had with A in 1999 and denied signing it
A copy of this email was sent to Sanderson Forensics for analysis.
The electronic file had been disclosed via email and it was this that was first supplied to us for analysis. An initial examination of the file structure revealed it to be an uncommon format and no dates were immediately evident except for a date in 1999 typed within the body of the document.
We were then supplied with a floppy disk containing a copy of the file. It was claimed that this was the original and only copy of the file in existence and the defendant expressed surprise that he had found the disk in an old box so long after it had originally been written.
It was obvious from the file properties (the last written date was in January 1999 but the created date was in 2008) that the file had been copied to the disk shortly after it had been disclosed via email.
We made brief statements to the court and as a result the defence engaged their own expert to carry out an examination of a range of computer media at the defendants premises. The story that emerged from this examination was that following the request for electronic disclosure of the original agreement, the defendant had searched his home and discovered the floppy disk containing the loan agreement. He had then cut and pasted the file from the floppy disk to a thumb drive in order to then transfer it to an Internet connected computer (which had no floppy drive) and emailed it to his solicitors. He had then copied it back to the floppy disk thereby updating the created date to 2008.
The file had been created in an old version of Lotus WordPro which was not readily available and as time was at a premium we wrote software to carry out an examination of the file properties and to extract encoded dates. Our conclusion was that the file had in fact been created some four years after it had been claimed. (Note - This was subsequently verified when we managed to obtain a copy of the original software and examined the file in its native format.)
We were also able to establish that the floppy disk containing the file had been formatted just minutes before the file had been copied to it.
Our first report was served and the judge was none too pleased with the defendant who, it appeared had omitted some vital evidence (the thumbdrive which had allegedly been used to transmit the file from the floppy disk). The defendant was then ordered by the court to produce all computer media and hand it to his expert. An additonal USB thumbdrive was handed to the defence expert who examined it and submitted a second report offering an amended version of events that appeared to suit the emerging picture.
Again the respondents team were using time against us and we were unable to carry out a full examination of all the newly produced computer evidence (the images of the computers had not been provided to us). However we were able to obtain electronic copies of a number of files, that we specified by name, from the media that had been examined by the defence expert and an image copy of the thumb drive. We were able to show that A had not produced all of the media as ordered by the judge and that a 64MB USB thumbdrive that was not produced had been used in the days leading up to the production order. The thumb drive that had been disclosed had been recently formatted and large amounts of data had been written to it. Further, we identified that a link file produced by the defence expert as evidence of the transition of the file from the floppy disk to a desktop computer was in fact a link to second copy of the file that had not been disclosed.
Despite only being provided with a fragment of the evidence and working to very tight deadlines, based on our final report the case was settled for a sum in excess of £240,000.
|
|
|
