| The stories are true; the names and places have | | | | blockers?" Gofer's look of befuddlement answered |
| been changed to protect the potentially guilty. | | | | for him. I explained to Bigshot International that a |
| A dame, a rich guy, and an email account: what | | | | write blocker is a device that can be hooked up |
| more do you need for a story? | | | | between the hard disk and the cable it is attached |
| I was in my office one fine spring day in Marin | | | | to, or between an external enclosure holding the |
| studying the benefits of Eastern philosophy, | | | | hard disk and the USB cable leading to the |
| engaged in my special snoring meditation, when | | | | computer. The MyKey NoWrite FPU is one of my |
| the buzzing of the telephone dragged me back to | | | | favorites. The Tableau works well. The Disk |
| the present. It was Sam & Dave - not the | | | | Jockey Forensic wasn't around then. The |
| Soul Men, but the lawyers in the Valley. They had | | | | DriveDock & others would have been fine. |
| a situation. A computer expert was heading over | | | | But he didn't have any by anyone. |
| to their offices to make a copy of their client's | | | | Still, removing the hard disk, attaching it to his |
| computer - the dame's laptop - to try to prove | | | | system and booting the system from his floppy |
| that she sent endearing emails to a scorned male | | | | diskette should have been fine. I suggested as |
| - the rich guy...Mr. Silicon Valley. | | | | much. "How do you take out the hard disk?" he |
| See, rich guy had not been so rich until some | | | | asked. Apparently laptops are different in London |
| computer hardware of his design had been | | | | and Hong Kong and those other places he had |
| snapped up by a big player in the computer world | | | | offices. |
| for a hefty sum. Newly rich Mr. Silicon decided to | | | | I asked S & D's secretary for a little Phillips |
| try his hand at picture books - picture books of | | | | screwdriver, and removed the hard disk for Our |
| natural looking young ladies in their native birthday | | | | Man. "It doesn't hook up to my IDE cable," he said. |
| attire. The hook was that they would be all | | | | You see, laptop IDE hard disks and desktop IDE |
| natural - no silicone for Mr. Silicon. | | | | hard disks are different sizes. Most in laptops are |
| One day, Mr. S was driving through the Rockies | | | | 2.5" and most in desktops are 3.5" and never the |
| when he espied a liberated young lady. Liberated | | | | twain shall meet - at least, not on the same cable. |
| in the sense that she was 17, but living on her | | | | The 40-pin connector on the laptop is, |
| own. S offered to liberate her from a deadend | | | | unsurprisingly, smaller in size. "How about an |
| waitress job if she would come live in his Valley | | | | adapter?" I said. "Have you a 2.5" to 3.5" |
| mansion. It would all be very Platonic - they'd each | | | | adapter?" |
| have their own end of the mansion - and she | | | | "Have we got one, Gofer?" Befuddlement |
| would work with the picture book office staff. | | | | answered wordlessly again. I suggested a quick |
| But as our young lady reached adulthood, Mr. S | | | | run to the local computer store. I even |
| became enamored enough to make our lovely | | | | volunteered to go, for the Mensa-level technical |
| waif a bit uncomfortable. She thought he was | | | | skill was getting to me a little at that point. |
| acting like a creep. She wanted out - out of the | | | | Twenty minutes later, we had an adapter from a |
| office and out of the mansion. The word | | | | local Mom & Pop computer shop. Some |
| "harassment" strikes fear into the heart of many | | | | adapters for laptop drives hook up the opposite |
| an employer, and Sam & Dave were looking | | | | way from what is intuitive. Once I warned against |
| for a settlement to enrich all involved. But Mr. S | | | | hooking the laptop drive up backwards, Bigshot |
| was not to give up so easily. He maintained that | | | | got everything set up right, the computer booted, |
| the lovely Miss had been sending him endearing | | | | and a good copy seemed like it was only minutes |
| loveletters from her America OnLine account. | | | | away. That is, until I heard, "My target disk drive |
| Sure enough, her account had sent those letters - | | | | isn't big enough." Well, I didn't want him to have to |
| but had she been the one to send them? AOL | | | | go all the way to Tokyo or New York for |
| has a setting that allows a user to sign in | | | | another. I suggested hooking up additional drives |
| automatically - that is, to sign in without having to | | | | from his special briefcase to the SCSI bus, then |
| type in a password. This setting is nearly always a | | | | changing the image size. Many computer forensic |
| mistake, unless no one else is ever near your | | | | programs allow one to acquire a large drive as |
| computer. I always recommend to my clients that | | | | several or many contiguous images of a smaller |
| they take the extra 5 seconds out of their busy | | | | size. By changing his configuration, Mr. B could |
| schedules to type an actual password. You might | | | | make many successive CD-sized images of about |
| have guessed that her AOL was set to | | | | 650 MB each, instead of one giant one that |
| automatically login. | | | | wouldn't fit in the available space in any one of his |
| But the letters had been sent after she had | | | | hard drives. |
| already left the office. That meant that if she had | | | | With the copy proceeding apace, I asked |
| sent them, she must have drafted them on her | | | | S&D what I should do next. We saw the |
| laptop from home. A deal was made. Mr. S hired a | | | | estimated time of completion was about five |
| computer expert to do some digital discovery. | | | | hours away! I wondered if sitting waiting for |
| He'd make an identical copy of the hard disk from | | | | electrons to move was the best use of my time |
| her laptop, while sitting in Sam & Dave's | | | | and their money, and they seemed to think it |
| conference room. This is where I entered the | | | | was not. I explained what to look out for - any |
| picture. S & D wanted me to make sure | | | | cables being unplugged, any keyboards being |
| that the hired thugs ... er, experts ... would not pull | | | | typed on, any utterances of "oops" or "oh no!" |
| any funny stuff. I went to observe on the day of | | | | from the Dynamic Duo making the copies. The |
| the copying. | | | | job should be mostly babysitting until the copy |
| Just a short half hour or so after their scheduled | | | | was completed. I headed back to the airport, and |
| arrival, the other experts arrived. They were | | | | to my office at Burgess Forensics to finish my |
| decked out in full company regalia. Their bright | | | | interrupted meditation. |
| jackets, hats, and business cards announced their | | | | How did it all turn out? There were no loving |
| offices in New York, Tokyo, London, Hong Kong, | | | | emails drafted on the laptop. The computer she |
| and Los Angeles. These guys were apparently | | | | had used at the office was being used to send |
| internationally jetting big shots. As it turned out, | | | | bogus emails from her auto logon AOL account. |
| only one was the bigshot - the other guy was the | | | | Mr. S was ready to settle... after just one more |
| gofer. Bigshot sat in a chair and bragged about his | | | | meeting. |
| exploits while Gofer unloaded their equipment. A | | | | As part of the settlement, Mr. S & our lovely |
| large, high-powered desktop computer, with | | | | Miss had one last lunch together. They met at an |
| external drives hooked up through an Adaptec | | | | outdoor café. It might have been |
| SCSI host adapter appeared on the tabletop. A | | | | romantic, but Miss sat well out of reach, her |
| briefcase full of secret computer forensic | | | | lawyer sat just out of earshot a couple of tables |
| software was opened to reveal its treasures. The | | | | to the West. The attorney for S sat just out of |
| golden floppy disk was removed from the | | | | earshot a couple of tables to the North. |
| briefcase. Bigshot examined the laptop, and | | | | Everybody ate lunch. S paid the bill - three bills, |
| announced, "We can't do this copy - there's no | | | | actually - one for lunches, one for the lawyers, |
| floppy drive." | | | | and one settlement for the lovely lady. She then |
| I was a little dumbfounded. Surely these guys had | | | | walked away and never looked back. |
| all of the computer forensic equipment known to | | | | While I never met the lady, I was alerted to look |
| mankind. "I have EnCase and ByteBack," he said, | | | | for her on a fashion show. There she was, on the |
| "but I need to boot from a floppy drive to make | | | | TV, looking like the waif models are apparently |
| a copy." This was at least half accurate. | | | | supposed to resemble. I couldn't tell if she looked |
| Whenever a drive is operated in a Windows | | | | any richer, but I hoped she would spend some of |
| environment, Windows writes bits and pieces of | | | | the settlement on a few more lunches - she could |
| data to the drive. Under such circumstances, the | | | | have filled out a little and looked a bit |
| data is changed and is not a true identical, | | | | more...natural. But that's outside my area of |
| "bit-for-bit" copy. It's not a forensic image. But | | | | expertise. A nutritionist I'm not - I do computers. |
| when the system is booted from a DOS diskette, | | | | This is just one of the many "CSI* - Computer |
| nothing gets written to the hard disks. This is | | | | Forensics Files: Real Cases from Burgess |
| what the fellow was looking to do. | | | | Forensics" cases in the file. Stay tuned for more |
| I suggested he remove the hard disk from the | | | | stories of deceit uncovered by science. |
| laptop, and hook it up through a write-blocker to | | | | *The (online) Free Dictionary lists more than 160 |
| his desktop computer. "What's a write-blocker?" | | | | definitions for CSI - for us it's Computer Scene |
| he asked. "Gofer, do we have any write | | | | Investigation. |