|
| |
Actual Computer Forensics Cases
During
his years as a Special Agent with the Florida Department of Law Enforcement, Mr. Rehman performed countless computer forensic examinations,
resulting in successful criminal prosecutions. This included the discovery of
evidence that the perpetrator believed he had destroyed and evidence that was
secured by encryption. In one case, his examination cleared the defendant.
Since
retiring from FDLE in 1998, Mr. Rehman has conducted numerous examinations in civil
litigation and employment matters. Below are some of our previous
forensics cases.
 |
The Board of Directors of a corporation
suspected that the president was concealing important terms of an agreement with
another corporation. The president resigned after our analysis found evidence
confirming the Board's belief.
|
|
The director of information
technology at a corporation was suspected of intercepting the email of the
CEO and several other key employees. Our examination found proof of his
activities, resulting in his resignation.
|
|
In
one case, an employee quit her job unexpectedly. Her employer was suspicious
that she was over billing clients and pocketing the profits. An analysis of
their Macintosh billing system revealed that, in an attempt to cover her tracks,
the employee had deleted hundreds of client records. Mr. Rehman was able to
recover all of the deleted records.
|
|
Computers
leave trails of their user's activity. Mr. Rehman analyzed a computer for a
company and discovered that an employee had been using it to do personal
research using very expensive databases.
|
|
In
the examination of a computer used by a fired employee, Mr. Rehman found a
detailed business plan that they had written. The plan was for a business to
compete against their employer and included information about other employees
that would quit to form this new company.
|
|
A
key employee of a large corporation left to start a competing business. Before
leaving, he formatted the hard drive of his company laptop in an attempt to
destroy evidence of violating a confidentiality agreement. His emails, letters,
memorandums, and business plans were all recovered from the laptop.
|
|
Mr.
Rehman was asked by a State Attorney's Office in Florida to review evidence in a
child pornography prosecution. Mr. Rehman conducted a thorough forensic
examination of the defendant's computer, a very old (in computer terms) IBM
model PS1. A dozen child pornography files were found on the hard drive. Mr.
Rehman's expertise, however, lead him to the inescapable conclusion that the
defendant was being framed; the charges against the defendant were
dropped.
|
|
Mr.
Rehman conducted an examination of a computer for child pornography. The
defendant admitted to having downloaded "a few" images many months
earlier, but claimed he had destroyed them. Mr. Rehman's examination revealed a
large cache of encrypted files; he was successful in breaking the password and
recovered dozens of child pornographic images the defendant was collecting and
maintaining. The defendant pled guilty.
|
|
Another computer belonged to a defendant who claimed
he had never downloaded any child pornography. The defendant admitted to having
deleted numerous files prior to a search warrant, but denied they were child
pornography. In examining all of the materials seized, Mr. Rehman found numerous
back-up tapes. Numerous child pornographic images were found on the back-up
tapes; the defendant pled guilty. |
|
