Information Technology Reference
In-Depth Information
The.next.day.in.court.the.plaintiff's.attorney.asks.the.court.
to.allow.him.to.depose.(deposing.means.to.question.in.a.spe-
cial.meeting.called.a.
deposition
),.the.defendant's.IT.manager..
The. court. allows. this. and. the. deposition. is. scheduled. and.
occurs.some.days.later..In.deposition,.the.IT.manager.for.the.
defendant.admits.that.he.was.asked.by.management.to.set.the.
computer.time.clock.back.on.the.manager's.computer.and.did.
so.on.the.date.noted.by.our.heroes,.the.forensic.sleuths.
At.that.point.the.defendants.for.some.odd.reason.agree.to.
settle.the.case,.cease.and.desist.from.marketing.the.product.
in. question,. and. pay. all. court. costs. as. well. as. a. substantial.
award.to.the.plaintiff..Case.closed.
This.example.illustrates.many.of.the.ways.that.the.integrity.
and.ownership.of.electronic.evidence.can.be.manipulated.and.
used.to.either.obfuscate.or.prove.the.integrity.of.that.data.
We.look.a.little.closer.at.the.issue.of.time.and.time.stamps.
in.the.next.section,.but.in.the.end.the.ability.to.prove.who.
did.what.and.when.is.often.the.entire.crux.of.any.assertion.in.
court.or.otherwise.
To.establish.the.“who”.is.often.dificult,.especially.in.situa-
tions.where.more.than.one.person.uses.a.computer.or.other.
electronic.device..There.have.also.been.cases.where.defen-
dants. have. used. the. “virus”. defense. and. insisted. that. they.
were.not.guilty.of.whatever.crime.was.shown.to.have.taken.
place.from.their.computer.because.they.had.a.virus.and.the.
“virus.made.them.do.it.”
This.defense.might.have.some.merit,.but.there.will.need.
to.be.some.evidence.to.show.this.is.the.case,.such.as.actual.
virus.evidence.on.the.device.
In. establishing. ownership. one. can. sometimes. ind. evi-
dence.in.the.metadata..Some.applications.will.record.the.user.
name.either.from.something.a.user.typed.into.the.application.
itself.or.from.the.person.logged.in.at.the.time..However,.that.
can.be.relatively.easy.to.dispute.as.without.an.actual.camera.
taking.pictures.of.who.is.typing.on.the.computer.at.the.time.
the.document.is.created,.there.is.no.sure.way.to.tell.if.some-
one.else.had.control.of.the.computer..The.logged-in.person.
