After a networking meeting, the group’s attorney asked for a few minutes of my time.
Steve: Thanks for staying late, Dan. I have a few computer questions for you.
Me: OK. Fire away.
Steve: Can you recover deleted files from a laptop hard drive?
Me: That’s kind of a loaded question, Steve. Perfect environment, yes, I could. If the system has been used, since then? Maybe. There are a lot of variables.
Steve: OK. Here’s the situation. A nasty divorce. My client, the wife, has her husband’s laptop computer. She says that he deleted videos and e-mails that were on the machine.
Me: Forensic data recovery is expensive, Steve. With no guarantee of success.
Steve: I understand. And we would pay your fees, if we get the information we need.
Me: No, Steve. If I spend time on this, I get paid that time. If I succeed to retrieve ANY data, whether it helps you or hurts you, I get paid for my success, not yours. That is how you work and get paid, as a divorce attorney.
Steve: OK. How much are we looking at, here?
Me: That will depends upon the size of the hard drive, any special measures taken to remove the data, and so on. It will be at least X dollars.
Steve: Great! We can do that. Can you come by the office to pick up the machine?
Me: Sure. I will follow you there.
…
Steve: OK, here it is. And here is the power cord. Oh, and the bag has a backup drive in it, too. Maybe that will help.
Me: Alright, Steve. Anything else? Any special handling instructions? Am I looking for a specific file type?
Steve: Oh! You can do that? We are needing deleted e-mails, deleted vidoes. Anything that will show him to be a deviant and put her in a positive light before the judge. He is very wealthy and trying to avoid sharing with her what she helped him build up.
Me: OK. I got it. I will let you know as soon as I get anything out of the machine.
That evening, I determined that windows had been reinstalled. The backup contained undeleted e-mails and videos. The problem for Steve is they were of the wife, not the husband. Sharing this with Steve, the next day, I was asked to show him what I found.
…
Me: OK, Steve, here are the printouts of the e-mail I managed to recover. She has been planning this divorce for a couple of years. She has been having an affair this entire time. Her plan, according to this e-mail is to take half of everything from him.
Steve: I can’t use any of this. This will hurt our case.
Me: Then you don’t want to watch the videos I recovered. Especially, this one. It was downloaded from a filesharing site.
Steve: What does it show?
Me: Her, in bed with some guy. You can hear her stating that she was going to take him for half of his business and everything. She even brags that she did nothing to work for any of it, but to marry him.
Steve: OK. I’m going to need you in the court, in case there are any questions about the condition of the machine, when it was handed over to you. I need you to be able to share he re-installed windows to erase the files.
Me: Steve, I can not testify that ‘he’ did that. I can only testify that ‘someone’ reinstalled Windows.
Steve: OK. I can still use that.
Me: OK. Here is the invoice for what I recovered. When do I need to be in court?
Steve: OK. I will get you paid for this, as soon as I get paid from her. And we are in court on Thursday of next week. I will e-mail you the details.
Me: Alright, but Steve, that invoice is made out to your firm, not to your client. I get paid, regardless of what happens with her. You have 10 days before that invoice is considered overdue.
Steve: Someone coached you well on this, didn’t they?
Me: Yes, my attorney helped me set up the details on my invoices.
At the divorce hearing, I was called to the stand by Steve.
Steve: Sir, I gave you a laptop that Mrs. Smith alleges was her husband’s laptop. Is that correct?
Me: Yes. You gave me a Dell Inspiron laptop, power supply, carry bag and a backup hard drive.
Steve: What was the purpose of my giving you that machine?
Me: To search for and restore missing or deleted data your client could use …
Steve: Thank you. What was the condition of the data on the hard drive when you initially started the machine?
Me: It had a fresh installation of Windows on it. No user data at all.
Steve: Were you able to recover any user data from the internal hard drive of that machine?
Me: No, sir, I was not able to recover anything, because the new install formatted the hard drive.
Steve: Is it possible to recover data from a formatted hard drive?
Me: Yes, it is, in some cases. Not all. By installing the new version of Windows on the machine, that user may have overwritten the very data I was asked to retrieve. I was unable to recover any data from the hard drive in the machine.
Steve: Thank you.
Other Attorney: Judge, if I may ask a few questions?
Of course the judge nodded. The room had probably a half dozen people on each side of the dividing aisle and I was neither the first nor the last to give testimony.
OA: Do you know who reinstalled windows on that machine?
Me: No, I do not.
OA: Do you know when windows was installed?
Me: Yes. Two weeks ago, last Tuesday evening.
OA: How difficult is it to reinstall Windows?
Me: On that machine? Very simple. Put the DVD in and turn the machine on. It will boot from the DVD and start the installation process. Then you only need to answer a handful of questions. The machine had no other programs on it, that I could find.
OA: You said you were unable to recover any data from the hard drive of the computer, correct?
Me: That is true.
OA: Did you check for any information on the backup drive, as you called it?
Steve: That drive is irrelevant to this hearing, your honor!
Judge: We will here what he has to say. You may answer the question.
Me: Yes, I did. I found a backup of the machine dated roughly a month prior to my having possession of it.
OA: Did you verify the content of that drive?
Me: Yes. The backup was verified as being complete and uncorrupted.
OA: What were the contents of that backup?
Me: A snapshot of the system as it was a couple of weeks before it was formatted and re-installed.
OA: Did you look through the back up for any incriminating evidence?
Me: Yes.
OA: What did you find?
Me: Nothing, that in my opinion would hurt your client’s case.
OA: Did you find anything that could potential help my client?
I sat silent for a moment until the judge prompted me to answer.
Me: Yes, I did.
Steve: Your honor!
Judge: You put him on the stand and under oath. You will have a chance to bring it back to point.
OA: Please describe what you found.
Me: I found a video that was her in bed, naked, engaging in sexual activity with the man on the aisle, three rows behind her. The video is quite clear and the audio where she brags of marrying him only for money was a wise investment of her time. And how he grew his small business into a much larger business without any help or input from her. But she was still going to get half of it.
OA: Would it surprise you to learn that laptop bag and it’s content were reported stolen the week before you state the machine was re-installed?
Me: I would have no way of knowing that, sir.
OA: Thank you very much for your time here, today.
Steve: Were you authorized to look into the contents of that backup drive?
Me: Not implicitly. You told me to find whatever I could that would help your case against him, as you handed the bag to me. The backup drive was in the bag. So I checked it as well for what you were asking me to find.
Two weeks later, I went to Steve’s office to collect payment for the two invoices. He would not see me, though he was in his office. The other attorney contacted me regarding being available to them, as needed. That is when I learned that the judge had granted everything to their client. The wife was granted 1 year of alimony of $1 per month.