Computer Forensic Case Study - Forgery & Fraud

NOTE: PROTEGGA LLC respects the privacy of all parties involved in each of its cases and; therefore, will not disclose cause numbers, company or individual credentials, or other items that may lead to identification.

Scenario

Type of Case: Family Law
County: Tarrant
Plaintiff: Mrs. X
Defendant: Mr. Y

Description: Mrs. X and Mr. Y divorced. Once Mr. Y had remarried, a few years later, Mrs. X decided to sue Mr. Y for additional assets. Mrs. X presented a document purported to be a contract, outside of the Divorce Decree, between she and Mr. Y. This case was filed as a civil suit and was referred back to Family Court.

Summary

Timeline
Purported Contract Signed: June 5, 2003
Divorce Finalized: June 20, 2003
Mrs. X Purchased New Computer: June 1, 2005
Suit Filed: September 26, 2005

Claims of Plaintiff
Mrs. X claimed the contract was provided to her by Mr. Y in return for her agreeing to the divorce settlement. Mrs. X further claimed the contract was lost by her only to be rediscovered just prior to her filing the suit.

Defendants’ Response
Mr. Y claims the contract was a forgery.

Computer Forensic Evidence Recovered
There were three computers available to Mrs. X on which the purported contract could have been created. Only one of the computers contained information to support Mr. Y’s claims. Mrs. X purchased a new computer on June 1, 2005, but did not begin to install the computer until June 10, 2005. On June 28, 2005, Mrs. X performed her first login on the new computer.

PROTEGGA was able to recover in excess of 75% of the purported contract from Mrs. X’s new computer system over seven months after the document was deleted. Data was recovered from both unallocated file system space and from slack space at the end of newer files. While all metadata was completely overwritten, and; therefore, not recoverable, a timeline was established based upon dates that data was overwritten and from the Microsoft Windows Registry.

Through a detailed analysis of the computer system, it was verified that the contract was created between the dates of June 28, 2005 and July 3, 2005. Further editing continued until August 31, 2005. The computer forensic evidence indicated at least six different edits occurred from July 20, 2005 and August 31, 2005.

Through interviews with Mr. Y and his new spouse, PROTEGGA learned that Mr. Y, his new spouse, and his two children were on a 14 day pleasure cruise during the timeframe in which the contract was created.

Conclusion

There was irrefutable computer forensic evidence pointing to the fraudulent creation of the purported contract. Once the contract was adjusted to fit “just so” on three pages, it was printed and a final signature page was added. With an accurate timeline created, Mrs. X finally conceded and, in order to avoid criminal charges, withdrew her case with prejudice.

For more information about PROTEGGA LLC or this case, feel free to contact us:
AskThePman@protegga.com
214.227.9752
[back]