Computer Forensic Case Study - Criminal Law

NOTE: PROTEGGA LLC respects the privacy of all parties involved in each of its cases and; therefore, will not disclose cause numbers, company or individual credentials, or other items that may lead to identification.

Scenario

Type of Case: Criminal Law
County: Tarrant
Plaintiff: Ms. X
Defendant: Mr. Y, Cellular Company A, Reseller Company B

Description: Mr. Y and Ms. X were divorced on December 15, 2004. Since their separation in May 2004, there have been ongoing issues with harassment, stalking, and physical abuse. Cellular Company A purchases bulk time from a national carrier and is required to be licensed by the FCC. Reseller Company B simply resells the services provided by Cellular Company A, but Reseller Company B has the ability to gain access to Cellular Company A’s records.

Important: Ms. X was a customer of Cellular Company A, but not a customer of Reseller Company B. Additionally, there is a large amount of evidence, computer and other, we are in the process of attaining that will undoubtedly solidify our findings. The current findings are based upon the 2 computers belonging to Ms. X, her cell phone, her phone records, Cellular Company A’s customer support records, and information found on the Internet.

Note: This case required the use of both private investigation and computer forensic techniques.

Summary

Timeline
September 9, 2006 – Online cell phone account access setup.

September 11, 2006 – Ms. X’s yahoo email accounts were accessed. Ms. X’s online cell phone account was modified.

September 12, 2006 – Ms. X’s yahoo email accounts, myspace.com account, and cellular phone records were accessed. Mr. Y found access to current cell phone data.

September 13, 2006 – Ms. X calls Cellular Company A’s customer support and verified someone had setup online access to her account. Account was disabled.

November 5 & 6, 2006 – Arguments over emails, myspace.com, and cell phone use directly led to a physical assault leaving Ms. X hearing impaired in her left ear.

January 23, 2007 – Someone entered Ms. X’s home and spent the majority of the day retrieving information from her computer. Items were also removed from the home.

Claims of Plaintiff
Ms. X believes that during the September timeframe that her ex-husband had some type of access to her cell phone records. Ms. X further believes that someone broke into her home sometime in January and accessed her computer.

Preface
During the August/September 2006 timeframe, there was a short term attempt at reconciliation. While most of us know that physical and emotional abuse never stops, an abused spouse seldom recognizes the problem. Anyway, due to the attempt, Mr. Y was allowed in the home during September and even spent a few nights there. This allowed him access to one of the two computers in the home. Of course, he would only use the computer in the daughter’s room where he could close the door. The other was in the living area downstairs.

Evidence Uncovered
On September 2, 2006, Mr. Y began the process of hacking into Ms. X’s online accounts, including three separate Yahoo email accounts, a myspace.com account, a match.com account, and her Cellular Company A cell phone account. Eventually, he figured out that her online cell phone access had not been set up and on September 9, 2006, Mr. Y setup online access under her name.

On September 11, 2006, Mr. Y successfully breached Ms. X’s Yahoo email accounts. This same day Mr. Y received two separate emails containing Ms. X’s cell phone bills via her Yahoo email account. He then forwarded these emails to his own email account, removed all evidence of this emails from her Yahoo account, and reviewed two cell phone bills belonging to Ms. X. Also, on this day, Mr. Y modified her online cell phone setup using his email address, his name, his address, and changed billing to email only.

On September 12, 2006, Mr. Y again reviewed the cell phone bills and accessed her Yahoo email accounts. This was the day he successfully breached Ms. X’s myspace.com account. With the assistance of a Reseller Company B, Mr. Y retrieved cell phone activity for this day that was not available in the cell phone bills or online. This access to her current data made her suspicious and on September 13, Ms. X called into Cellular Company A, verified an account had been setup, verified the identity on the account, and had the account disabled.

Over the course of the rest of September and October, almost continuous arguments ensued over jealous accusations and blind obsession on the part of Mr. Y. Ms. X still had no clue that Mr. Y had access to her Yahoo email and myspace.com accounts. The arguments finally came to a head and, on November 5 & 6, Mr. Y again assaulted her. This time permanent hearing damage was the result. She filed criminal charges against him and obtained a Protective Order.

Mr. Y persistently violated the Protective Order and continued to stalk and harass Ms. X. On numerous occasions he violated her home space and even spent three nights living in her backyard shed. Thousands of text messages and phone calls were placed. Some of the text messages strongly suggested there was imminent danger of suicide.

On January 23, 2007, while Ms. X was at work, Mr. Y broke into her home and spent the entire day retrieving data from her downstairs computer. The upstairs computer in the daughter’s room had died in early October. While in her home that day, he reviewed and replaced with blanks, six CDR discs. He also removed two floppies and a cell phone. The cell phone was later found in his possession by his eldest daughter. Four days later, Mr. Y files for full custody of the children and to release the Protective Order.

Six days after the release of the Protective Order, Mr. Y asked Ms. X on a date consisting of drinking, a motel room, and sex.

Conclusion

There are an abundance of indicators that numerous State and Federal violations have occurred. Some of the possible violations include: Breach of Computer Security, Computer Fraud, Harassment, Stalking/Cyber Stalking, Criminal Trespass, Burglary, Fraudulent use or possession of identifying information, Protective Order violations, numerous Federal laws under Title 18 including, but not limited to, pretexting, unlawful access to stored communications, and unauthorized access to financial data.

All information has been turned over to the District Attorney. Additionally, this investigation will provide evidence extremely valuable in Mr. X’s civil case.

For more information about PROTEGGA LLC or this case, feel free to contact us:
AskThePman@protegga.com
214.227.9752
[back]