CSI18 - The Case of the Deadbeat Beauty

The Case of the Deadbeat Beauty

Not everything always works out in Forensicland. Sometimes we strike out. In more ways than one.

Then the phone rang and a delightful voice answered. Ginger Justín. She laughed; she loved my jokes; she thought I was brilliant. She said I was perfect for her. As an expert. I reminded her of her dad. Her deceased dad. I should have taken the cue.

It seems that Ms. Justín’s dad had passed away – possibly with the help of Lynn Dallas, live-in companion – a companion who was in the latest version of dad’s will. Not only that, Ginger – kind, caring, lovely Ginger – had been written out of the will. Her siblings were still in there. The grandkids were still in there. Ms. Dallas’s companion animal was in there, for dog’s sake! Money for the companion’s companion! But nothing for Ginger.

Something had to be done. The poseur had to be exposed before she took yet another old man’s fortune. As Ginger informed me, this was Dallas’s M.O. Get to know the old guy, move in with him, become a love interest (“She never loved him; she was just after his money!”), then help him shuffle off the planet when the time was right. Ginger’s legal eagle, Big Dan Tuberosa, concurred. “This is a bad woman, this Dallas. She must be stopped.”

So I asked for a catalog of devices that might hold various versions of the will. Mr. Justín had quite a setup. Racks with networking gear upstairs and down. Several computers and laptops. Lots of backup hard drives. Ginger asked if I could pick them up at estate administrator, John Geering’s place in Silicon Valley. And if I could cut this poor heroine break on the price.

Thirty years of being in the biz has taught me the hard way that when someone tries to wheel & deal with you, it’s a red flag. Every dollar discount seems to come with a five-spot decrease in respect. It’s an odd part of human nature that giving away a C-note makes people think you’re an easy mark. But her desperate charm kicked in and I said I’d pick the gear up next time I was up that way. It turned out that Yahoo! News wanted my input for an online interview/article called: “True/False: Never Sell Your Old Phone,” so after the interview, I went to Geering’s nearby digs to fetch the stuff.

When I came downstairs from his office, there was Ginger, waiting to greet me. She was long, lank, and lean, except where it counted. Her flaming red hair was alight with the afternoon sun. She leaned up against me with a languid, lasting hug and asked me to share a beer at a local sidewalk café, where we could discuss the case.

I picked a table outside, in everyone’s view, just to play it safe. A local Firehouse IPA cooled my flushed face and settled my nerves enough to unaddle my wits. The roar in my ears subsided. I heard more about how much Ginger’s dad loved her. I heard more about how her siblings (the ones still mentioned in the Will) were relying on her to get the real story out, in their father’s memory. I heard how Ginger had to do this all by herself. I heard more about the evil Miss Dallas. I heard how this case would be worth tons of money and couldn’t I do part of my fee on a contingency basis?

As it turns out, expert witnesses are not allowed to work on a contingency basis. The image of the hired gun would be inevitable. Regardless of the circumstances, being paid by how much you win just doesn’t fit with the ethics of complete honesty on the stand. Like the Lamas teach, attachment to the outcome just causes suffering.

We still had the matter of a contract and a retainer to deal with. Big Dan assured me that Ginger was good for it, but it’s never a good idea to get started without something written down. She signed the contract and cut me a check.

With this behind us and some tech talk put into lay terms, we decided on a strategy.

She thought two computers (with 3 disk drives) would be most likely to bear fruit.

• I would, of course, make a forensic image of each of the hard disks, using FTK Imager through a write blocker.
• Do a keyword search with EnCase for terms and phrases taken from known versions of the Will, and provide the results as a spreadsheet for each search term.
• Recover deleted files.
• Look for Willmaker documents, including by finding a hexadecimal signature for those files, then search and carve them out with Blade.
• Find when and on which computer there had been Wills created, modified and accessed.
• Provide a complete listing via spreadsheet of all files with Creation, Last Written, and Last Accessed Dates, amongst other file attributes.
• Dig up all existing and deleted History entries, using NetAnalysis and HstEx
• Find what USB devices had been attached to each computer (in case there were more discoverable devices).
• Find out if file-wiping software had been installed.

Ginger spent many hours trying to sort through the data. I spent many hours on the phone explaining. She was bright, but her head just wasn’t built for electronic spreadsheets – it was built for storytelling, and she composed a storyline to fit her narrative.

When I explained that the facts didn’t fit, she asked me in a throaty voice if I couldn’t please, please make this one adjustment to what I though the data meant? Through more red flags, I had to assume she was pulling my leg. The data is the data. As a famous TV cop once said, “Just the facts, Ma’am.”

The defendant’s counsel agreed to take my deposition over the phone. When an attorney is getting ready to try to take me apart, I like to be able to read his body language, so phone depos are not my favorites. I could hear Big Dan and Ginger in the room, along with the other lawyer.

1455 blg

CSI18 – The Case of the Deadbeat Beauty

admin

Leave a Reply Cancel reply

Related Posts

Leave a Reply Cancel reply