Toggle Nav

Description: Jane Doe and Richard Roe divorced. Once Richard Roe had remarried, a few years later Jane Doe decided to sue Richard Roe for additional assets. Jane Doe presented a document, purported to be a contract outside of the divorce decree between Richard Roe and her. This case was filed as a civil suit and was referred back to Family Court.

Type of Case: Family Law
Court: Tarrant County in Fort Worth, TX
Plaintiff: Jane Doe
Defendant: Richard Roe


Purported contract signed: June 5, 2003
Divorce finalized: June 20, 2003
Jane Doe purchased new computer: June 1, 2005
Suit filed: September 26, 2005

Claims of Plaintiff
Jane Doe claimed the contract was provided to her by Richard Roe in return for her agreeing to the divorce settlement. Jane Doe further claimed the contract was lost by her,  only to be rediscovered just prior to her filing the suit.

Defendants’ Response
Richard Roe claims the contract was a forgery.

Computer Forensic Evidence Recovered

There were three computers available to Jane Doe on which the purported contract could have been created. Only one of the computers contained information to support Richard Roe’s claims. Jane Doe purchased a new computer on June 1, 2005 but did not begin to install the computer until June 10, 2005. On June 28, 2005, Jane Doe performed her first login on the new computer.

Protegga was able to recover, more than seven months after the document was deleted, in excess of 75% of the purported contract from Jane Doe’s new computer system. Data was recovered from both unallocated file system space and from slack space at the end of newer files. While all metadata was completely overwritten, and, therefore, not recoverable, a timeline was established based upon dates that data was overwritten and from the Microsoft Windows Registry.

Through a detailed analysis of the computer system, it was verified that the contract was created between the dates of June 28, 2005 and July 3, 2005. Further editing continued until August 31, 2005. The computer forensic evidence indicated that at least six different edits occurred from July 20, 2005 to August 31, 2005.

Through interviews with Richard Roe and his new spouse, Protegga learned that Richard Roe, his new spouse, and his two children were on a 14-day pleasure cruise during the time frame in which the contract was created.


There was irrefutable computer forensic evidence pointing to the fraudulent creation of the purported contract. Once the contract was adjusted to fit “just so” onto three pages, it was printed, and a final signature page was added. With an accurate timeline created, Jane Doe finally conceded and, in order to avoid criminal charges, withdrew her case with prejudice.

NOTE: Protegga LLC respects the privacy of all parties involved in each of our computer forensics investigation cases and, therefore, will not disclose cause numbers, company or individual credentials, or other items that may lead to identification.