Description: Jane Doe and Richard Roe are divorcing, and both desire custody of their two boys. Jane Doe had possession of a laptop computer shared between Richard Roe and her during their marriage. A computer forensics investigation of the laptop revealed some out of the ordinary activity. Armed with this information, an order was granted for an additional investigation of Richard Roe’s work computer.
Type of Case: Family Law
Court: Rockwall County in Rockwall, TX
Plaintiff: Jane Doe
Defendant: Richard Roe
Complication: There existed a Social Study unfavorable for Jane Doe. Due to the Social Study, Richard Roe had full custody of the children and was receiving $1,000/month from Jane Doe. Based upon Jane Doe’s current salary, her final child support payments were estimated to be $1,500/month.
Investigation on shared laptop: June 7, 2006 through June 18, 2006
Judge orders “No changes to work computer:” July 7, 2006
Judge also orders “Agreement to view work computer:” July 7, 2006
Richard Roe’s employer sent subpoena for somputer: July 14, 2006
Judge “again” orders “Access to work computer:” August 9, 2006
Protegga imaged Richard Roe’ss work computer: August 26, 2006
Completed analysis of Richard Roe’s work computer: September 18, 2006
Hearing to discuss the issue of spoliation: November 20, 2006
Mediation scheduled: December 13, 2006
Trial by jury scheduled: January 2007
Claims of Plaintiff
The Social Study was biased against Jane Doe and didn’t accurately portray Richard Roe’s true identity.
Jane Doe is an alcoholic and a danger to the children. Anything Jane Doe claims is not true. “I didn’t do it.”
Computer Forensic Evidence Recovered
Numerous examples were found covering a wide-array of pornography, including male, female, she-male, lesbian, very young women, and more. A few examples of violence and/or disrespect towards women were also located including a videotaped incident with Jane Doe in their home. There was a small group of friends discovered that share their pornographic Internet findings frequently, of which Richard Roe is included and actively participated.
The Social Study
Richard Roe extensively modified a witness’s original questionnaire responses with statements to make himself appear to be an outstanding parent and portray Jane Doe as a horrifying example of motherhood to the counselor performing the Social Study. The original, the modified, and the final questionnaire responses were recovered from Richard Roe’s work computer.
Richard Roe obtained, installed, and executed this software tool specifically designed to thwart forensic investigations, according to its developers, www.evidence-eliminator.com. This was done after a non-destruct order was issued. Richard Roe also took numerous steps in an apparent attempt to hide the installation date of this software. Richard Roe made a statement through his attorney that Evidence Eliminator was installed and maintained by the company as a matter of policy. The computer forensic evidence, coupled with the deposition testimony of Richard Roe’s employer and co-workers, proved this to be a false statement. See Case Study – Spoliation.
There was an abundance of data remaining on Richard Roe’s work computer exhibiting almost identical activity from that located in the original laptop investigation. Finding this similarity was the purpose in investigating the work computer. In addition, Protegga uncovered substantial evidence to support claims of spoliation, multiple occurrences of perjury, and witness tampering.
During a final mediation attempt, a settlement was reached. The custody of the children was split between the parties, Jane Doe’s child support payments were eliminated, and Richard Roe agreed to reimburse Jane Doe for expenses caused by his spoliation. Based upon the statements from legal counsel, without the computer forensic evidence, Jane Doe would not have reached such a favorable settlement.
NOTE: Protegga LLC respects the privacy of all parties involved in each of our computer forensics investigation cases and, therefore, will not disclose cause numbers, company or individual credentials, or other items that may lead to identification.