Case Studies

A Miami-based corporation contacted Forensic Recovery, LLC to determine if a recently terminated executive had transmitted proprietary information to a competitor, who was suspected of currently using protected content within a uniquely formatted database. A review of the executive's computer, carefully secured and protected prior to the individual's termination, did identify both email correspondence between the executive and the competitor, as well as collaborative evidence that such content had been copied to removable storage media prior to the departure. The former employee agreed to pay the corporation a non-disclosed restitution and fully covered the expenses resulting from the forensic examination.

A corporation had determined through electronic discovery that an IT employee who had been recently terminated had allegedly created a catastrophic loss of an insurance database. A previous examination of the evidence revealed compelling evidence that the suspected IT Administrator had remotely accessed the network, deleting all use names and passwords, as well as medical records and other medical-related data. Forensic Recovery, LLC was hired to conduct a review for a third party directly affected by the destruction. The review corroborated the original findings and added further collaborative evidence in identifying the offender.

The government continues to adapt to the changing environment related to Internet crimes against children. Chat rooms interactions, traveler investigations, and possession and distribution have long been the focus of such investigations. A more current investigative technique involves automated searches of peer-to-peer networks, where the government searches for child pornography through the use of MD5 or SHA1 hash values (an electronic fingerprint of image content). A database of such images and their related MD5\SHA1 values are readily available - and lead the investigator to a specific computer which makes the content available. One popular peer-to peer program is LimeWire. Forensic Recovery has been very successful addressing LimeWire cases, often leading to dropped or reduced charges. Each case is unique, so feel free to contact Forensic Recovery, LLC to determine what investigative approaches can be developed to facilitate an effective defense.

A key element of possession of child pornography involves knowledge and control by the alleged offender. There are numerous areas of electronic evidence that provides explicit evidence as to knowledge and control. In 2009-2010, Forensic Recovery, LLC was hired by a Florida-based law firm whose client faced federal charges of possession and distribution of child pornography. An examination of the evidence identified evidence sufficient to have the charges reduced to a non-sex offense and a withheld adjudication.

In 2007, Forensic Recovery, LLC was hired by the Federal Public Defenders Office to conduct a review of evidence in a highly publicized terrorism case. Over a period of almost one year, the government continued to examine evidence and provide such findings as discovery. The evidence in question, although compelling on face value, was presented in pieces that never seemed to fit. A comprehensive review of investigative reports and examination of electronic evidence facilitated the acquittal of the client.

In 2009, an individual was arrested for violating his terms of supervised release for possessing child pornography. It should be noted the original charge and subsequent incarceration was also for possession of child pornography. The client's position was that the government left behind evidence in the original search and that the new charges should not apply. An examination of the evidence provided indisputable evidence that the files in question were not missed during the original search, but had in fact been acquired after the client's supervised release.

In 2009, a West Palm Beach client requested a complete examination of his computer's hard drive. This request came after a filing for divorce and an allegation by the client's wife that child pornography had been seen on the client's hard drive. The client was concerned that someone might have stored child pornography on the hard disk drive. A forensic duplication of the hard disk drive was generated and an exhaustive examination conducted. The client was assured that virtually no images in violation of federal or state statutes were stored on the hard disk drive.