A closer look at how digital forensics can help determine if a finalized document was altered after-the-fact.
The following descriptions highlight a variety of matters for which Vestige has been retained that involve alleged document alterations. Each of these cases are real matters that we have worked, but for privacy and confidentiality purposes the relevant information has been sanitized. These cases are not the entire population of cases matching such criteria, but instead represent a wide sample of the cases we have worked in this specific area. Should you need additional information, please contact us.
Individual v Large Manufacturer | Wrongful Termination
Vestige was involved in this employment dispute (alleged wrongful termination) as a computer forensic expert to assist counsel and their client in determining whether disciplinary documentation had been altered ex-poste facto of the incident. Considerable testing and validation of the particular document was undertaken by Vestige to validate that while the document had been altered after the termination date, that the information that had specifically been altered was consistent with the employer’s sworn testimony.
State v Individual | Criminal Defense Matter
Vestige was engaged by outside counsel in a criminal defense matter whereby Vestige was able to prove that the log files of instant message conversations being used as evidence against the individual were not accurate representations of the original conversation. Through thorough evaluation and testing of the document and the system from which they were generated, Vestige was able to determine that the evidence being presented as authentic evidence was not the original, authentic evidence. Thorough testing and understanding of the application in use by law enforcement revealed subtle nuances and anomalies that provided proof that the documents were not the original log files.
Individual v Individual | Will Contest
Vestige was engaged in a probate dispute surrounding the authenticity of a digital tape recording made during a series of advisory/consulting meetings that our client and the opposing side and their counsel attended surrounding a bitter will contest. Through sophisticated analysis of both the analog and digital evidence stored upon the digital media, Vestige was able to show that not only had the original media been altered after the meetings were held, but that the recordings provided to our client during the discovery phase did not include relevant and damaging (to opposing side) evidence. Vestige was able to recover the “missing” information and expose the fraud committed by opposing side.
Buyer v Seller | Failed Business Purchase
Vestige was engaged by the Seller of a business after the deal was called off by the Buyer in the “eleventh hour”. The Seller alleged that the Buyer breached the Letter of Intent by calling off the sale for reasons other than those allowed in the Letter of Intent. As evidence of the Buyer’s true intents, the Buyer provided an Excel spreadsheet that allegedly was created immediately preceding the Buyer’s decision to terminate the sale. Seller alleged that the Buyer withdrew from the sale for other, non-permissible, reasons. Vestige analyzed the computer system of the Buyer and determined that the spreadsheet that was offered as evidence by Buyer was, in fact, created several months AFTER the decision to terminate the sale.
Designer v Manufacturer | Patent Infringement Matter
Vestige was engaged by the defendant in a highly contentious patent infringement matter whereby the date of creation of a particular patent was being called into question. Forensic analysis of both CAD diagrams as well as documents and e-mails traded between the Plaintiff and various patent counsel proved that prior art by both the Defendant and other designers preceded the date of invention by the Plaintiff, invalidating the patent claim.
Insurance Company v Insured | Insurance Fraud Matter
Vestige was engaged by a large insurance company in their investigation of the insured’s claim. The insured had suffered a catastrophic loss from a fire on a secondary residence. Immediately following the loss the insured presented a detailed list of every item within the secondary residence complete with values, approximate purchase dates, etc. The insured declared that it was simply a recollection of what was in there, created immediately after the event. Due to the level of detail provided in the document the insurance company initially believed that the fire to be arson-related and that the document was created prior to the fire in an effort to maximize the claim. Our analysis indicated that in fact this was not the case and that the document was created after the fire, however, it was based upon records that the insured had been keeping on the computer that existed months to years prior to the fire. Our client, the insurance company, was satisfied with those results and immediately paid the claim.
US v Individual | Fraudulent Calendar Appointment
Vestige was hired by the defendant in this criminal defense matter to help establish that a questionable calendar event and transactions within a contact management system was not manipulated by him. This individual was targeted by the District Attorney for an alleged action. Central to the matter and critical evidence against our client was an electronic calendar entry showing that he had met with a particular individual on a specific date. Our forensic analysis and testing of the artifacts left behind by this application revealed that a disgruntled, former employee which turned out to be the informant to the government was the one that had manipulated the calendar record to correspond with the story of the government agency. Our findings resulted in a significantly reduced plea bargain.
Law Firm v Law Firm | Falsification of Time Entries
Vestige was engaged by the Defendant in a quasi-malpractice and fraud matter for which the law firm had previously been engaged. Upon settlement of the matter at-hand the defendant was ordered to pay for the Plaintiff’s attorney fees. Upon presentation of the fees there was a significant discrepancy between the fees that were charged by the Plaintiff versus those charged by the Defendant in a matter that was fairly symmetric. The Defendant hired Vestige to review the electronic billing records of the Plaintiff firm to determine the timing of the time entries, as there were allegations by the Defendant that Plaintiff law firm inflated the fees and entered these at the tail-end of the litigation. Vestige’s forensic review of the Plaintiff law firm’s time entry system revealed that this was not the case and that the Plaintiff law firm had been appropriately entering the time entries throughout the entire engagement.
Individual v Individual | Falsified Last Will & Testament
Vestige was engaged by the children of the decedent, in a will contest between the immediate family and the stepmother and her children. Our clients alleged that the step-mother took advantage of the decedent’s declining state-of-mind and ailing health to force changes to the will that were favorable to the step-family. Forensic analysis of the workstation used by the stepmother revealed significant alterations to the will prior to filing that occurred at times that would have been impossible for the decedent to have been the one to make the changes. The stepmother had resorted to some advanced means of obfuscating the changes, including using a non-standard application to avoid falling victim to built-in tracking of changes in Microsoft Word. In the end, that didn’t matter, as the recovery of, testing of and reporting of the specific remnants and digital artifacts by Vestige proved that the changes to the documents were improper. Upon presentation of the forensic evidence identified by Vestige, the stepmother admitted to the scheme.
State v Individual | Video Analysis of Traffic Stop
The defense counsel for an individual involved in an alleged improper traffic stop resulting in an Operating a Vehicle under the Influence (OVI), engaged Vestige to review the dashboard camera footage from the traffic stop. During defense counsel’s initial review of the video they became concerned because they observed anomalies within the video and quality degradation that made it appear that the video may have been altered. Similar to many of the video enhancement and video alteration matters that Vestige is involved with, we examined both the content of the video as well as the artifacts and other markers that are present within recorded video. In the end Vestige was able to provide undisputed proof that the video was accurate and that the quality degradation and anomalies observed by the defense counsel was a pattern and indicative of failing hardware as opposed to an attempt by law enforcement to alter the evidence. By conducting this work prior to accusing the Prosecution, the defendant was able to graciously accept a plea bargain without making public the allegations, likely resulting in a drawn out legal battle and less favorable plea bargain terms.
CONTACT US today to discuss how Vestige’s Forensic eExamination of digital evidence can assist with your document alteration case.
