The case of dead beauty
Not everything always goes well at Forensicland. Sometimes we cross out. In more ways than one.
I was looking out the tall windows of my office at the blue, blue sky of Santa Barbara, not a single cloud in sight. It was my 50-something birthday. The invoices were ignored. It seemed like a perfect day.
Then the phone rang and a lovely voice answered. Justin ginger. She laughed; loved my jokes; she thought I was brilliant. She said I was perfect for her. As an expert. I reminded him of his dad. His deceased father. I should have taken the signal.
It appears that Ms. Justin’s father had passed away, possibly with the help of fellow resident Lynn Dallas, a partner who was listed in the latest version of Dad’s will. Not only that, Ginger, the kind, loving and charming Ginger, had been removed from the will. His brothers were still there. The grandchildren were still there. Ms. Dallas’s pet was there, for the dog’s sake! Money for the companion of the companion! But nothing for Ginger.
Something had to be done. The phony had to be exposed before she took another old man’s fortune. As Ginger informed me, this was the Dallas modus operandi. Meet the old man, move in with him, become a love interest (“She never loved him; she was just after his money!”), Then help him get off the planet when the time was right. Ginger’s legal eagle, Big Dan Tuberosa, agreed. “This is a bad woman, this Dallas. She has to be stopped.”
So I asked for a catalog of devices that could contain various versions of the will. Mr. Justin had a big trap. Racks with networking equipment above and below. Various computers and laptops. Many backup hard drives. Ginger asked if she could pick them up at the property manager, John Geering’s home in Silicon Valley. And if I could reduce the price of this poor heroin.
Thirty years of being in business has taught me the hard way that when someone tries to manage and deal with you, it is a red flag. Every dollar off seems to come with a five point decrease in respect. It’s a weird part of human nature that gifting a C grade makes people think you’re an easy brand. But his desperate charm kicked in and I said I’d pick up the gear the next time I was awake like that. It turned out that Yahoo! News wanted my opinion for an online interview / article called: “True / False: Never Sell Your Old Phone”, so after the interview, I went to the nearby Geering excavations to look for things.
When I came downstairs from her office, Ginger was waiting to greet me. She was long and thin and thin, except where it counted. Her flaming red hair was lit by the afternoon sun. He leaned into me in a long, languid hug and asked me to share a beer at a local sidewalk cafe, where we could discuss the case.
I chose a table outside, in full view, just to play it safe. An IPA from the local fire station chilled my flushed face and calmed my nerves enough to unleash my wits. The roaring in my ears subsided. I heard more about how much Ginger’s dad loved her. I heard more about how her siblings (the ones still mentioned in the will) trusted her to bring out the true story, in memory of their father. I heard how Ginger had to do all of this herself. Heard more about the wicked Miss Dallas. I heard this case would be worth tons of money and couldn’t I be part of my fees on a contingent basis?
It turns out that expert witnesses cannot work contingently. The image of the hired gunman would be inevitable. Regardless of the circumstances, getting paid for what you earn doesn’t fit the ethic of total honesty on the stand. As the Lamas teach, attachment to the result only causes suffering.
We still had to deal with the matter of a contract and an advance. Big Dan assured me that Ginger was good at it, but it’s never a good idea to start off without something written. She signed the contract and gave me a check.
With this behind us and some technical talk in layman’s terms, we decided on a strategy.
She thought that two computers (with 3 drives) would be more likely to bear fruit.
• Of course, I would forensically image each of the hard drives, using the FTK Imager through a write blocker.
• Perform a keyword search with EnCase for terms and phrases taken from known versions of the will and provide the results as a spreadsheet for each search term.
• Recover deleted files.
• Search for Willmaker documents, even finding a hexadecimal signature for those files, then find them and cut them with Blade.
• Find out when and on what computer wills were created, modified, and accessed.
• Provide a complete list via spreadsheet of all files with creation, last write, and last access dates, among other file attributes.
• Dig up all existing and deleted history entries, using NetAnalysis and HstEx
• Find which USB devices have been connected to each computer (in case there are more discoverable devices).
• Find out if file cleaning software has been installed.
As you can imagine, it took a bit of time and produced a large amount of electronic documentation. This amount of data would remove a large part of the forest if you sent it as impressions. Those reams of paper are not free, and since I was not working pro bono, the time to print it would not be free. Faced with the reality of having to pay for my time, Big Dan and Ginger agreed to keep it on file even though they did not want any electronic correspondence to be traced later. They wanted the email communication to be silent on the subject of what we found. The CYA alarms inside began to sound. More flags started to go up …
Ginger spent many hours trying to classify the data. I spent many hours on the phone explaining. He was brilliant, but his head just wasn’t made for electronic spreadsheets, it was made for storytelling, and he composed a story that fit his narrative.
When I explained to her that the facts did not fit, she hoarsely asked if she could not please, please make this adjustment to what I thought the data meant. Through more red flags, I had to assume that she was teasing me. Data is data. As a famous television cop once said: “Just the facts, ma’am.”
The defendant’s attorney agreed to take my statement over the phone. When an attorney is preparing to try to disarm me, I like being able to read their body language, so phone statements are not my favorite. He could hear Big Dan and Ginger in the room, along with the other attorney. We got into the topic of what modification, creation, and access dates meant. As I explained, I could hear Ginger ask for a break to check on her son, who said he was sick at home.
Then my office phone rang and the number was hers. His son was fine. She had called to try to change reality a bit. Although he had trouble navigating a spreadsheet, he insisted that I was wrong in my testimony about the dates of the files. I had to explain that I knew a thing or two about them and that I had performed the experiments myself to confirm them. She had done it too, she said, and I was wrong. I must admit I was a bit nervous. I tried to explain that Windows 7 and XP treat certain dates a little differently. I had to stand my ground and Ginger was furious.
Even so, they decided to take it to court all the way. Ginger prepared a stack of shredded paper spreadsheets and faxed them to me. Now I was the one having trouble interpreting the spreadsheets as I couldn’t make hers stick together. I did my best. Nobody wants a beautiful woman to think that they are despising her.
Then he sent me a fax about the 100 points he wanted me to testify about. I spent more hours explaining that there were a lot of things in there that I just couldn’t say. I felt like I was on a debating team. I should have quit right then and there, but I stood my ground until she said, in writing, that if she couldn’t answer a particular point in a particular way, she insisted that I say she didn’t know the answer. Even if that hadn’t been the height of an ethical violation, it would be perjury.
I leave.
I called Big Dan and told him that I was withdrawing from the case and that he really should tell his client not to ask a court official to commit perjury. But Dan still believed in this terrible temptress. And the court was coming. I let them convince me to go to court under the following circumstances: Ginger was no longer speaking to me, only attorney Dan; no one would try to influence my testimony, including Big Dan; and I had to receive an immediate payment to cover the overdue bill, as well as the next testimonial.
Done and done. I quit. I wish the agreement would stick.
What should have been a few hours on the booth turned into two full days. Ginger sat with her attorney, frowning, shaking her head and trying to get him to say the “right” things. Every one of his experts, his lawyer and the judge was a fool, and every one of the opposition was brilliant. The breaks were full of accusations and this beautiful woman who could make so many people dance to her tune simply couldn’t get the facts to say what she wanted, no matter how many times she changed her mind about what they should mean. .
They asked me to stay one more day as a rebuttal witness for the next boy, but I couldn’t. I had to deal with reality and dating.
Well, in the end, I was left holding the bag for one day’s court billing, and karma caught up with the toxic temptress. Maybe it was her histrionic, her fluent way with the truth, or just that Dad had excluded her from his heritage for some strange reason. But after more years of working in the court system, the evil Lynn Dallas finished with what Will gave her and the sneaky siren got a piece of Karma.
So now I sit, brooding over flags and signs and that blue Santa Barbara sky. Pay a little more attention to what the universe has to show a guy who makes a living digging up the truth with a forensic shovel. Trying to see what’s coming before the almighty has to hit me on the forehead with a mallet to get my attention. And hold down the fancy rags for the next court date with the facts.