Image MASSter Solo-4 Forensic review
April 29, 2010
reviewed by Jonathan Krause: Here’s two things you can be sure of; hard drives will constantly increase in capacity and the requirement to finish the job as soon as possible at minimum cost will be an ever present. So any device which may result in being able to complete our tasks quicker has got to be worth a closer look. Creating forensic images is the foundation of our work, but let’s face it, is pretty boring and even worse, dependent on where it’s being done, can be actively hostile. Happily, there’ve been some recent developments in the field of imaging, with the all-in-one devices of the Image MASSter Solo 4 Forensic and the Logicube Forensic Dossier being released... Read full review
FBI: Finding criminal data on cell phones and game consoles is tough
April 29, 2010
Non-traditional communications devices such as smartphones and game consoles pose a particular problem to law enforcement agencies trying to milk them for forensic data that reveals criminal activity, attendees were told at the 2010 Computer Forensics Show in New York City... More (NetworkWorld)
BlackBag Technologies Releases Mobilyze for iPhone, iPod touch and iPad Data
April 29, 2010
BlackBag Technologies, Inc. has announced the release and general availability of Mobilyze, a new generation of forensic analysis software specifically designed to analyze iPhone, iPod touch and iPad data...
SC Suite v4.1 Released
April 28, 2010
A new version of SC Suite is available, version 4.1 now includes more tools to analyse and extract information from a variety of file types and utilities to assist in every day tasks. Continuing user feedback has resulted in the development of 64 tools packaged as a single suite for $95 per license...
PeerLab released – software for scanning and analyzing P2P-Software
April 28, 2010
PeerLab is a scanner for P2P-programs, WebDisks and Usenet-Clients and can also evaluate important P2P-databases. One of the main advantages is that it does not need any special requirements and is portable (e.g. runs from a USB-stick). The software comes with a dongle which is recognized as a "human interface device" and needs no special drivers. The user-interface comes in German and English. More information
Advanced StegAnalysis: Demystifying Steganography Investigation
April 28, 2010
WetStone is offering Advanced StegAnalyis at Techno Security 2010. During this is a two-day advanced training class, detailed analytical and jamming methods will be utilized to both discover and disrupt Steganographic operations. Analysis of Steganographic file systems, streaming steganography and Voice Over Internet Protocol (VOIP) based steganography will be covered. A host of both open source and proprietary technologies will be utilized during this class. More information
Trial Court Abused Discretion in Ordering Forensic Examination Absent Pending Request for Production or Motion to Compel and in Appointing Special Master
April 26, 2010
In re Art Harris, 2010 WL 1612205 (Tex. App. Apr. 22, 2010)
In this case, the appellate court granted petitioner’s writ of mandamus and ordered the withdrawal of three underlying discovery orders upon finding that the trial court abused its discretion when it ordered the production of petitioner’s hard drives for forensic examination and when it appointed a special master to conduct that examination.
While the facts are somewhat complicated, it suffices to say that in the course of discovery, petitioner Art Harris was ordered to turn over relevant “electronic media” for forensic investigation despite the fact that there was no pending request for production of such media, no pending request for production of any kind with which he had not complied, and no pending motion to compel. The order compelling production was, instead, the unlikely result of a motion to compel such production from a different defendant. Despite initially indicating that Harris could produce only non-privileged responsive data, the court’s order compelling production of electronic storage media nonetheless included Harris. The court also ordered the appointment of a special master to conduct the forensic examinations.
In addition to compelling Harris’s production of relevant electronic storage media, the court also failed to address Harris’s motion for a protective order and claims of privilege.
Following entry of its order, the court denied Harris’s motions for clarification and reconsideration. Accordingly Harris filed a petition for writ of mandamus.
The appellate court relied heavily on the Texas Supreme Court’s analysis in the recent case, In re Weekley Homes, L.P., 295 S.W.3d 309 (Tex. 2009), which confirmed that pursuant to Tex. R. Civ. P. 196.4, electronic information is subject to discovery only upon a specific request for its production. Additionally, the Supreme Court recognized that “‘[p]roviding access to the information by ordering examination of a party’s electronic storage device is particularly intrusive and should be generally discouraged, just as permitting open access to a party’s file cabinets for general perusal would be.’” Specifically, the Supreme Court stated:
As a threshold matter [to receiving an order compelling examination of a party’s electronic storage device], the requesting party must show that the responding party has somehow defaulted in its obligation to search its records and produce the requested data. The requesting party should also show that the responding party's production "has been inadequate and that a search of the opponent's [electronic storage device] could recover deleted relevant materials." Courts have been reluctant to rely on mere skepticism or bare allegations that the responding party has failed to comply with its discovery duties.
Accordingly, the appellate court found that the trial court abused its discretion:
We conclude that the trial court abused its discretion not only by compelling production of overly broad discovery without addressing Harris’s motion for protective order and without a motion to compel discovery from Harris before it, but also by issuing its even more invasive order that Harris produce his hard drives and by failing to require [plaintiff] to make any showing that the benefit of the discovery she sought outweighed the burden and expense to Harris.”
The appellate court also found that the trial court abused its discretion when it appointed a special master because the case did not meet the “exceptional case/good cause standard of Rule 171.” In so concluding, the court noted the trial court’s “conflation of the roles of a forensic examiner and a special master.” To clarify, the court noted that a special master may be appointed in “exceptional cases, for good cause” and “has and shall exercise the power to regulate all proceedings in every hearing before him and do all acts and take all measures necessary or proper for the efficient performance of his duties.” A forensic examiner “is a computer expert whose sole purpose is to create forensic images of a particular… device and then to search the images for specified documents using a list of search terms.”
The trial court was therefore ordered to withdraw its discovery orders compelling production and appointing the special master.
A copy of the full opinion is available here.
Case in Point 2010-04-26 05:00:08
April 26, 2010
About ‘Case in Point’ – ‘Case in Point’ is a weekly cartoon series, created by CaseCentral Corporation, that illustrates the lighter side of eDiscovery. ‘Case in Point’ also runs a contest inviting anyone from the expansive eDiscovery realm – lawyers, IT staff, judges, service providers, paralegals, writers and consultants – to submit their own humorous experience or a scenario they find particularly funny. Participants may submit cartoon ideas online at http://www.casecentral.com/caseinpoint/idea for consideration. Readers who see their idea turned into a cartoon will receive a copy of the final cartoon signed by the artist, Tom Fishburne.
Permission to reproduce ‘Case in Point’ cartoons is granted on the conditions that any cartoon used is reproduced “as is” and that the re-use is not for purposes of resale or direct compensation. Please provide CaseCentral with a copy of any such use by sending an email with attached sample to: caseinpoint@casecentral.com.
Case in Point mailing list – Visit www.casecentral.com/caseinpoint/mailsignup/ to have Case in Point sent weekly to your eMail. To opt out, send an email titled “UNSUBSCRIBE” to caseinpoint@casecentral.com.
Case in Point Resources – Get the ‘Case in Point’ one year anniversary screen saver: www.casecentral.com/case-in-point/resources/ or ‘Case in Point’ mobile for your iPhone or Blackberry: www.casecentral.com/case-in-point/mobile/.
Case in Point Café - Visit http://www.cafepress.com/CaseInPoint to turn your favorite cartoon into a keepsake or gift for that special eDiscovery somebody.
About the cartoonist – CaseCentral is pleased to feature Tom Fishburne as the cartoonist behind ‘Case in Point.’ See Tom’s bio here: http://www.tomfishburne.com/tomfishburne/bio.html
About CaseCentral – Case in Point is sponsored by CaseCentral. Visit www.casecentral.com to learn more about CaseCentral’s eDiscovery products and services.
United States Supreme Court Hears Argument on Expectation of Privacy as to Text Messages on Work Pager
April 22, 2010
Quon v. Arch Wireless Operating Co., 529 F.3d 892 (9th Cir. 2008); City of Ontario v. Quon (08-1332)
In the summer of 2008, the Ninth Circuit held that a city employee had a reasonable expectation of privacy as to personal text-messages sent from his city-issued and city-owned text-messaging pager (‘pager”). The court further ruled that the employee’s Fourth Amendment rights were violated when his supervisor read those text messages, after requesting transcripts from the service provider. The city has appealed the court’s findings to the United States Supreme Court and oral arguments were heard on Monday, April 19th. An opinion is expected in June, 2010.
The relevant facts are as follows. In late 2001 or early 2002, pagers were issued to city employees, including Sergeant Jeff Quon, a member of the police department. There was no official policy regarding text-messaging on the pagers. The City did have a general “Computer Usage Internet, and E-mail Policy”, however, which made clear that the use of city-owned “tools” was limited to business and that “use of these tools for personal benefit” was a “significant violation” of the City’s policy. The policy also reserved the right of the City to monitor use and stated specifically that the email system was “not confidential”. In 2000, Quon signed an acknowledgement of this policy. In 2002, Quon attended a meeting at which Lieutenant Steve Duke informed the attendees that all pager messages were considered email and would fall under the City’s relevant policy.
An informal policy governing the use of the pagers developed. Specifically, the practice was that if employees went over their allotted character limit each month, they were responsible for paying the overage. Quon repeatedly accrued overages. Although the details of the conversation differ, the parties agree that Quon and Duke spoke about the overages. Duke claimed he told Quon that the he could pay the overages to prevent an audit, but also stated that the text messages were public records, subject to audit at any time. Quon claimed Duke told him that if he didn’t want his messages read, he should pay the overage fee. Regardless, Quon paid overage fees for exceeding the character limit “three or four times.”
In August 2002, Quon and another officer exceeded their limits. Subsequently, an audit of the pagers was ordered to evaluate the possible need to increase the character limit. Transcripts of the messages were obtained and read. Thereafter, an internal affairs investigation was initiated to determine “if someone was wasting…City time not doing work when they should be.” The investigation revealed that Quon had repeatedly exceeded his character limit and that many of the messages were personal an often sexual in nature. Quon and those he was messaging with sued the City for violating their Fourth Amendment rights.
The District Court found that Quon had a reasonable expectation of privacy in his text messages. The court further found that the reasonableness of the search turned on the purpose for which it was undertaken. Because it was undertaken for purposes of determining a proper character limit, and not to uncover misconduct (as determined by a jury), defendants were absolved of liability.
On appeal, Quon and the other Appellants noted their agreement that their expectation of privacy was real, but argued the issue of the reasonableness of the search should not have gone to trial because “it was unreasonable as a matter of law.” The Ninth Circuit agreed.
In reaching its decision, the court conducted a two-part analysis to determine a) if Quon had a reasonable expectation of privacy and b) if the search was reasonable. The court determined that Quon (and those with whom he communicated) had a reasonable expectation of privacy. Specifically as to Quon, the Ninth Circuit agreed with the district court that “the Department’s informal policy that the text messages would not be audited if he paid the overages rendered Quon’s expectation of privacy in those messages reasonable” and noted that the formal usage policies were not the “operational reality” at the department.
Regarding the reasonableness of the search, the court determined that although the purpose of the search was reasonable, its scope was not. By way of example, the court noted several alternatives to actually reading Quon’s messages that could have accomplished the goal of determining the need to raise the character limit, including allowing Quon to count characters himself. Accordingly, the court determined Appellants’ Fourth Amendment Rights had been violated.
The case was appealed to the Supreme Court of the United States, and oral argument was heard on Monday, April 19th. An opinion is expected in June, 2010.
A copy of the Ninth Circuit’s opinion is available here.
A transcript of the arguments before the Supreme Court is available here.
MSAB Announces Hawaii Five-O Competition for customers
April 22, 2010
Micro Systemation (MSAB) will release v5.0 of its XRY mobile forensic software pack to all existing customers on Friday 23rd April this week. To celebrate this new release; existing customers are being offered the opportunity to enter a competition to win a once in a lifetime holiday to Hawaii. The competition will run from 19th April to 14th May 2010 and the winner will be invited to fly to Hawaii and spend five days seeing the sights of the island culminating in a meeting with the Hawaiian Police Department. As part of the competition - the winner will hand over a brand new XRY system to the Hawaiian Police and tell them all about the benefits of using this technology to assist their investigations...