HSSK Group

The Role of Computer Forensics in Family Law Matters

Fri, 07 Mar 2008 22:00:00 GMT

Introduction

The effective implementation of the science of Computer Forensics can, and often is, an extremely effective method in building and collating evidence in family law matters. Many cases of custody and visitation have been solved or modified because of computer evidence recovered by a Computer Forensics expert.

Computer Forensics can assist lawyers in many areas including the recovery of financial information, decryption of passwords, recovery of instant messages and archived data for example.

In this paper, three particular areas of the investigative value of Computer Forensics in family law will be addressed;

· The Recovery of Deleted Files

· Detailed Internet History

· The Recovery of Deleted Email

Because so many families are using computers at work and in the home, the analysis of the family or spousal computer should always be considered.

Recovery of Deleted Files

During family law investigations, the recovery of deleted files can be paramount. This forensic recovery includes all file types (except email as discussed below) and can include spreadsheets, documents and financial applications.

What Happens to a Deleted File?

While most people are aware that the Microsoft Windows operating system allows the deletion of files to be reversed if the Recycle Bin is used, most users are not aware that a file that has been deleted and further deleted from the Recycle Bin (empty Recycle Bin) that the file may still be available on the computer hard drive regardless. The Recycle Bin can only hold a limited number of records, and is a FIFO stack: First In, First Out. This means that the files you delete earliest are emptied from the Recycle Bin first by Microsoft Windows when the Recycle Bin becomes full.

A computer hard drive is sectioned into millions of sectors to enable effective data storage, with each sector having its own unique address. As massive capacity hard drives are now main stream, a filing system is required to know where each file is located to allow files to be accessed when called upon. In modern computer systems running Windows XP or Windows Vista, this index is called a Master File Table (MFT).

For example, when a computer user opens Microsoft Word and attempts to open a previously created file, how does the computer system know where that files resides? Answer: The MFT works as an index and contains information regarding the actual physical sector location of all of the files stored on the hard drive. So, in this example, Microsoft Word accesses the MFT and requests the file. In turn, the MFT scans its own records (indexes) and provides the physical sector location of the file on the hard drive to the application (in this example, Microsoft Word) and the application accesses this unique address and opens the file.

Is the File Ever Deleted?

The interesting thing about this MFT system is that when a file is “deleted” all that actually happens is that changes are made to the MFT’s index entry to indicate the space occupied by this file (physical sector location) is no longer needed and is available for use. The file still resides at the very same physical sector location, but the operating system no longer knows about it. The file will stay there indefinitely, and is only truly deleted when a new file is placed into the same physical sector location by the MFT. Since standard hard drives now have capacities usually over 100GB (many millions of sectors), the chances of the same physical sector location being assigned by the MFT to store a new file are greatly reduced, making recovery of deleted files more likely by using forensically sound tools and techniques.

Internet History

The subject of Internet activity raises it’s head on many occasions during Computer Forensics investigations in relation to family law matters.

The first and most obvious way that this can be of assistance is by ascertaining exactly which websites a user has accessed. Sites visited such as www.onlinegambling.com or www.singlesdatingspace.com may indicate a certain type of online activity which may assist in collating information in relation to a person’s character or illicit actions. Other websites such as www.onlinebanking.com or www.offshoreassets.com may provide credible intelligence while investigating the possibility of hidden assets or unknown bank accounts. But the question is often posed, “Can web pages that the user has accessed be recovered?”

Temporary WebPages

As a computer user accesses websites, in the background and unknown to the user, a copy of the web page that is displayed on the screen is downloaded as a hidden file and is temporarily stored in a hidden system area of the Microsoft Windows operating system. This is not a bug in Microsoft Windows; it is in fact a feature! Microsoft intentionally implemented this function in an attempt to expedite web browsing, in the days before broadband and DSL connections were the norm. The concept is that if you have a temporary copy of the web page on your hard drive, and you return to this website, the local copy on your hard drive will be loaded instead of the online page, making access to the web page much quicker. This happens after a check is made to ensure that the web page has not changed since the temporary copy was created. If changes have occurred in the interim, the online updated version is accessed.

This feature of the Microsoft Windows operating system creates potentially important information for a family law attorney. With the correct tools and techniques, a suitably qualified and experienced Computer Forensics examiner can not only recover the local web pages that are stored in a hidden system area, but can also recover web pages that were created in this manner previously, that have since been deleted by the operating system as part of its routine maintenance.

This results in an unlimited amount of recoverable web pages (or information in relation to the web pages). Remember though, as discussed in an earlier section of this paper, deleted files are sometimes overwritten and therefore truly deleted.

Search Engine Search Terms

In addition to the recovery of deleted web pages, the search terms used in an online search engine can be recovered in much the same way. There are many instances where this information has proved crucial in investigations, particularly in relation to the intent to acquire explicit images, as well as sourcing offshore banking and locating a safe haven to store hidden assets.

Recovery of Deleted Email

In general terms, email messages can contain important information in family law matters. Whether they contain evidence of illicit behavior or secret bank accounts, email, and particularly recoverable deleted email can make or break a case. Because many email applications such as Microsoft Outlook are essentially a database, email continues to be stored after deletion until a purge at the application level is performed, or until the database becomes too large and automatic maintenance is performed by the operating system.

The database itself is similar in some ways to an MFT, in that the deleted data (in this case, email) is no longer in the database index when deleted, but still resides within the database. Computer Forensics tools and techniques provide the recovery of deleted email, bypassing the index in much the same way as the MFT can be bypassed.

Many family law matters focus on home computers where webmail may be more popular. Common web based email systems such as Yahoo.com or Hotmail.com do not in general use an application such as Microsoft Outlook to send, receive and store mail. Instead, the user simply navigates to a particular web page and logs on to the email system. The folders that are created by the user are stored on servers hosted by the email provider, not on the user’s local computer. The Internet History section of this paper discussed how web pages can be recovered. Web pages from web based email systems are not any different.

Selecting and Instructing a Computer Forensics Expert

As with any other service industry, there are usually several choices available when selecting Computer Forensic services. Selecting the right person or firm to work on your client’s behalf and providing effective instructions can be confusing if you have never engaged someone from this type of profession.

Items to Consider

Look for an examiner that has verifiable experience in family law matters. Computer Forensics examiners are engaged in many different types of cases, not all of which include family law. The advantages of choosing a firm with the relevant experience are numerous and include the awareness of the emotions of the conflicting parties. This is of particular importance when discussing evidential findings that may be upsetting to the client.

· Ensure that your Computer Forensic Expert or firm is licensed with the State of Texas as a Private Investigator, as required by Occupational Code Chapter 1702 (Private Security) http://tlo2.tlc.state.tx.us/statutes/docs/OC/content/htm/oc.010.00.001702.00.htm

· Provide specific instructions to the retained Computer Forensic Expert, and attempt to obtain a fixed fee based on the instructions. Ensure that the Computer Forensic Expert has only one point of contact. In many cases ambiguity can be caused by conflicting instructions from the attorney and the client themselves.

· Limit the scope of the investigation to what is specifically going to assist from an evidential point of view where possible.

· Ensure that you client is aware of the implications of Texas Penal Code section 43.26 in relation to certain types of explicit images http://tlo2.tlc.state.tx.us/statutes/docs/PE/content/htm/pe.009.00.000043.00.htm

· Do not let your client adopt the D.I.Y approach, or get a local I.T. friend to take a “quick look” to see what they can find. If this happens, not only does your client potentially overwrite recoverable deleted files simply by using the computer, but any evidence that may be recovered has credibility challenges immediately.

· Ensure that all items potentially containing electronic evidence are considered In addition to computer systems. This includes thumb drives, camera memory cards, Blackberrys and cell phones. In fact, any electronic device capable of storing data should be considered. Even IPods can store spreadsheets!

Summary

The implementation of a competent Computer Forensic examination can greatly benefit lawyers in family law matters. In particular, divorce cases with larger estates, complicated businesses, real estate holdings or cases with multi-jurisdictional assets can benefit from the information recoverable from deleted files, Internet history and the recovery of deleted email.

Additionally, custody and visitation matters are often resolved based on the scientific findings that a Computer Forensic expert can recover.

Finally, Computer Forensics tools and techniques ensure that all evidence is gathered in a recognized scientific manner, which is accepted by courts and tribunals worldwide. The failure to observe this may result in potential evidence being subject to authenticity questioning and ultimately disqualified.

Contact Information

David A. Greetham

Managing Director, Computer Forensics & E-Discovery Group

Hill Schwartz Spilker Keller LLC

dgreetham@hsskgroup.com

713.771.5011

About HSSK

Hill Schwartz Spilker Keller LLC (www.hsskgroup.com) is a business valuation, litigation consulting and Computer Forensics firm whose principals have been serving the corporate, legal and professional communities for over thirty years. The firm has offices in Houston, Dallas and Austin serving clients throughout the United States and internationally. The firm’s Computer Forensics laboratory in Houston is the nation’s first private Computer Forensics lab to be accredited by the American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB).

7-Mar-08 5:00 PM

Medical Practice Valuations in Changing Times

noemail@hsskgroup.com — Tue, 29 Nov 2005 16:00:00 GMT

A Discussion of Key Events and Market Trends Involving Physicians, Their Practices, and the Valuation of Their Business Interests.

For more information click this link: http://hsskgroup.schipul.net/attachments/articles/64/Barbo%20Presentation%20Bernstein%20Conference%20HO.pdf

29-Nov-05 10:00 AM

Valuation Services in Litigated Matters

noemail@hsskgroup.com — Tue, 29 Nov 2005 16:00:00 GMT

A Discussion of the Nature, Requirements, and Common Challenges Regarding Expert Valuation Services.

For more information click this link: http://hsskgroup.schipul.net/attachments/articles/67/HCA%20Expert%20Witness%20Discussion.pdf.

29-Nov-05 10:00 AM

Be Careful How You Dispose of a Computer, It Can Cost You a Bundle

noemail@hsskgroup.com — Thu, 23 Jun 2005 21:00:00 GMT

Be careful of how you dispose of computers you no longer need. New rules from the FTC impose severe financial penalties for not properly disposing of computer hard drives which contain consumer credit information.

Click here to read the entire PDF addressing "New FTC Rules Impose Significant Penalties for Inappropriate Disposal of Consumer Information."

23-Jun-05 4:00 PM

Refocus Raises Equity Using HSSK Fairness Opinion

noemail@hsskgroup.com — Fri, 11 Mar 2005 19:00:00 GMT

11-Mar-05 2:00 PM

HSSK Transactions

noemail@hsskgroup.com — Thu, 10 Mar 2005 19:00:00 GMT

Click this link to see a number of tombstones highlighting some of the ways we have assisted our clients. Tombstones.pdf 1015.768 KB (1015768 bytes)

10-Mar-05 2:00 PM

Computer Forensics: What is Metadata, Why is it Significant, and How do you Deal with it?

noemail@hsskgroup.com — Tue, 25 Jan 2005 22:00:00 GMT

Metadata, by definition, is data about data, or more simply, electronic data not necessarily seen on a printed document. It describes various characteristics of data, including when and by whom it was created, accessed, or modified. Because it is not normally seen, and some cannot be seen without using special applications, users can inadvertently share confidential information when sending or providing files in electronic forms.

For more information, Metadata 9-30-04

25-Jan-05 4:00 PM

Marc Schwartz Appointed Examiner In Morningstar Bankrupcy

noemail@hsskgroup.com — Thu, 02 Dec 2004 22:00:00 GMT

Marc Schwartz, a name shareholder resident in our Houston office, was appointed as the Examiner in the Morningstar Gas Inc. bankruptcy in Houston. Judge Marving Isgur in appointing Marc transferred control of the debtor's financial affairs to him as well as ordering additional work be performed by the Examiner.

Morningstar, an operater of gas wells in South Texas, filed for bankruptcy protection in September 2003. The Examiner expects to be involved in the administration of the debtor's financial affairs until well into 2005.

Marc Schwartz has served as a bankruptcy trustee in both the Southern and Western Districts of Texas and has served as accountant and financial advisor to Trustees and other parties involved in bankruptcy proceedings in those districts as well as the Northern District of Texas, the Western District of Oklahoma, the Northern District of Illinois and the District of Connecticutt.

2-Dec-04 4:00 PM

HSSK Assists Client To Double In Size

noemail@hsskgroup.com — Wed, 02 Jun 2004 15:00:00 GMT

Southwest Shipyard acquired the Brady Island and Pasadena shipyards of Firstwave Marine, more than doubling the company's barge repair and maintenance capacity. The acquisition also brought to Southwest the capability to build barges and boats as well as repair and maintain boats.

Marc Schwartz, a shareholder with HSSk, has served as a finaicial advisor to the board of Southwest, including working on this transaction. HSSK assisted Southwest in determining the purchase price, performing due diligence on the acquistion, reviewing the purchase agreements and assisting in addressing accounting issues. HSSK continues to advise Southwest's board following the acquisition.

2-Jun-04 10:00 AM

Hill Schwartz Spilker Keller represents the Centre for Advanced Property Economics at Financial Summit in Toronto, Ontario October 20-24

noemail@hsskgroup.com — Fri, 24 Oct 2003 14:00:00 GMT

Mike Hill, Sr. a named shareholder in the Firm and a member of its Management Committee will be representing the Centre for Advanced Property Economics at the Financial Summit, an international accounting and valuation meeting hosted by the Canadian Institute of Chartered Accountants in Toronto, Ontario from October 20-24.

The Summit includes an unprecedented series of joint public meetings by the International Accounting Standards Board, the Financial Accounting Standards Board, and the Canadian Accounting Standards Board. Mike will participate in a roundtable discussion on international valuation and accounting standards and their impact on financial reporting.

The purpose of the meetings will be to address such key issues as convergence of accounting principles, accounting for stock-based compensation and revenue recognition. Part of this process will be to address the need for uniform standards when determining the value of amounts presented in financial statements.

Mike is a Fellow of the American Society of Appraisers and a former Chairman of its Business Valuation Committee. He has served as a Trustee of the Appraisal Foundation and as its Chairman. The Appraisal Foundation is the entity charged by Congress with establishing and maintaining the Uniform Standards of Professional Appraisal Practice.

24-Oct-03 9:00 AM

The Valuation Professional as an Expert Witness

noemail@hsskgroup.com — Tue, 23 Sep 2003 20:00:00 GMT

THE VALUATION PROFESSIONAL
AS AN EXPERT WITNESS

By: J. Michael Hill, FASA

Valuation professionals are being called on more and more to assist attorneys or the triers of fact in litigation matters. Perhaps the most commonly recognized need for the valuation of a business is in a disputed family law matter when one (or both, in a community property State) of the parties is the owner of a closely held business. Other litigation areas requiring valuation include lost profits or business interruption, stockholder disputes or squeeze-outs, lender liability and contested estate tax matters. The skills necessary to perform a valuation of an entire business are the same as those required to calculate lost profits or "but for" damages.

The valuation expert must be well grounded in an understanding of finance, accounting, economics and marketing. The professional should have credentials or certifications such as ASA, CPA, CBA, or ABV that indicate that he or she has met testing and peer review qualifications and continuing education requirements. In addition to educational and certification requirements that provide the professional with the basic tools to perform the financial analysis, one must also exhibit good common sense. All analysis should pass the reasonableness test.

In addition to strong analytical abilities, the valuator, as a testifying expert, should exhibit good oral and written communication skills. Remember that in many federal courts (such as tax court), the written report is the direct testimony. The expert witness is there to assist the judge or jury in arriving at a reasonable conclusion. However, the "reasonable" conclusion reached by the expert will be subject to vigorous cross-examination by the opposing attorney. This examination can take many forms - from a well thought out logical attack on the methodology and assumptions used by the appraiser to the personal attack designed to impugn the integrity and credibility of the witness. One must be prepared to defend not only the analysis and methodology, but also the conclusion as to value or damage. We often say that a well-written report should lead the reader to a conclusion that is the same as that of the report writer. The same thing should be said about oral testimony.

We live (fortunately or unfortunately) in a litigious society. Much of that litigation involves disputes that center on closely held businesses. We are also seeing more and more litigation being settled via mediation prior to trial. The financial issues are often complex and challenging and call for professional expertise. Hill Valuation Group, LLC has been involved in litigation support for over twenty years and the senior members of the firm have testified on many occasions. We can assist you in this highly specialized area of business valuation.

23-Sep-03 3:00 PM

Special Valuation Issues For ESOPs

noemail@hsskgroup.com — Tue, 23 Sep 2003 20:00:00 GMT

SPECIAL VALUATION ISSUES
FOR ESOPs

By: Gerald A. Keller, ASA

Since the passage of The Employee Retirement Income Security Act of 1974 (ERISA), employee stock ownership plans (ESOPs) have been a viable alternative for many private companies. Increasingly they are being used as an "exit" strategy for long-term entrepreneurs who wish to allow a transition of ownership to employees while providing liquidity for themselves and their beneficiaries. Regardless of the motivation, a qualified, independent appraiser must appraise the stock held by an ESOP in a closely held company at least annually.

Because of an ESOP's unique status as a special type of employee benefit plan, valuations of closely-held stock held by one require the appraiser to consider certain issues which may not apply to other appraisals. Under ERISA, a participant must be given the right to redeem stock for immediate cash or a payout of up to five years. This "put" option may eliminate the typical Lack of Marketability discount usually reserved for private stock valuations. However, the appraiser must consider the overall ability of the company to fund such a buy-out. As time passes, this repurchase liability can have a significant impact on the cash flows of the business. Thus, a discount may still be appropriate.

Yet another issue involves a change of control. When a controlling shareholder sells a majority of his shares to an ESOP, a control premium may be justified and added to the stocks' value. However, the appraiser must be assured actual control (in form and substance) has passed to the plan, or will pass within a reasonable period of time by binding agreement. The change of control should also be anticipated to remain effective for a reasonable period. In other words, a rapid disposal of the plan's shares to below control levels cannot be anticipated in advance of the initial transaction.

These and other issues make ESOP valuations particularly challenging and emphasize the need for professional expertise. Hill Valuation Group, LLC can be of help in this specialized area of business valuation.

23-Sep-03 3:00 PM

S-Corporation, New Opportunity for Small Banks

noemail@hsskgroup.com — Tue, 23 Sep 2003 20:00:00 GMT

S-CORPORATION, NEW
OPPORTUNITY FOR SMALL BANKS

Securing an Independent Appraisal

By: Noel D. Luke

Passage of the Small Business Job Protection Act of 1996 (P.L. 104-188) brought about reforms to Subchapter S of the Internal Revenue Code, permitting small banks, for the first time, to become "S corporations." While this Act removes "double taxation" to bank earnings and shareholder dividends, all of the assets of the converting S corporation are subject to a built in gains tax due upon sale of such assets (within a 10 year period). Determination of the unrealized built-in gain requires the identification of the tax basis of an asset at the point it was acquired and its Fair Market Value (FMV) at the date of the S corporation conversion.

There are a variety of professional options that bank officers may use in establishing FMV for bank assets. The most risky is to cobble together tax authority valuations, internal assessments, and existing real estate appraisals. It is unlikely that all existing records will establish appropriate FMV's for assets on January 1 of the year in which the S Corporation election is made.

Experts in the banking industry recommend the most secure option in determining FMV is to engage an independent / third-party appraiser. This suggestion is good advice for any C corporation making this conversion. Qualified appraisers will review bank financial results and individual assets and then apply one or more of the three approaches to value determination: cost, market or income. It is recommended that banks retain a business valuation (BV) appraiser to accomplish this.

The BV appraiser's assignment is to determine a FMV for the full banking enterprise as well as the individual assets. Bank assets with unrealized built-in gains generally include loans, investments and real estate (e.g., drive-ins). An accredited BV appraiser is qualified to establish an enterprise value as well as a value for loans and investments. Serving as "general contractor," the BV appraiser will "sub-contract" other appraisal specialists to prepare valuations for real properties and other tangible assets. The reports would then be incorporated into the BV report. The key is that a FMV be assigned by a qualified professional to each underlying asset in the bank's portfolio as of day one of the election year.

What should bank officers and their support experts look for in professionals that provide this type of service? It is recommended that they consider relevant work experience, certifications, academic degrees, and knowledge of the banking industry. They should also look at the appraiser's experience in defending valuation findings against IRS challenges, and also in serving as expert witnesses in litigation, such as minority shareholder lawsuits. The professionals at Hill Valuation Group, LLC meet these criteria and can provide a defendable appraisal when a conversion is advantageous.

23-Sep-03 3:00 PM

What is My Practice Worth: An Overview of the Valuation of Medical, Dental, Legal, Financial and Other Practices

noemail@hsskgroup.com — Tue, 23 Sep 2003 19:00:00 GMT

WHAT IS MY PRACTICE WORTH?

An Overview of the Valuation of

Medical, Dental, Legal, Financial and Other Practices

By: James M. (Mike) Hill, ASA

To answer this question, the practitioner/owner must have a basic understanding of the appraisal process and the issues which impact value in today's rapidly changing service industry. This brochure will summarize the approaches available to an independent appraiser to determine the worth of a practice and the key elements that comprise value in a typical practice. It will also address some of the issues that may impact an appraiser's value conclusions.

In many situations, such as the sale of a practice or a divorce, a practice's value is subject to scrutiny by regulators, the courts, or the IRS. Thus, it is essential to establish an independent opinion of Fair Market Value to help avoid possible challenges.

Fair Market Value is the most widely applied standard for determining a practice's value. It is generally defined as the amount at which property would change hands between a willing seller and a willing buyer when neither is under compulsion and both have reasonable knowledge of relevant facts. *

A business appraiser uses three approaches to estimate the value of a practice:

Asset Based - Determines specific tangible values.

Market Based - Compares actual recent sales of similar practices.

Income Based - Uses analysis of the practice's earnings expectations and the risks associated with those expectations.

Most practices have two major elements of value: Tangible and Intangible.

Tangible Value consists of all operating assets, less liabilities. Such assets may include accounts receivable (adjusted for collectability), office and equipment, furnishings and facilities.

Intangible Value is usually associated with recurring practice earnings.

The term Goodwill is often used to describe Intangible Value.

There can be significant restrictions on the transferability of Goodwill. Most limitations arise from "self-referral" and "anti-kickback" laws and regulations that may vary with the identity of a specific buyer.

These restrictions create distortions in the market-based approach, and can lead to significant under-valuations of practice worth.

To avoid possible problems, it is often necessary for an appraiser to identify and value separately specific elements of Intangible Value. These specific intangible elements can include patient files, a proficient trained staff, and a separate trade name.

Values determined for purposes other than sale (divorce, estate taxes, etc.) may be significantly different because of unique legal requirements and standards applicable to each situation.

Hill Valuation Group has been performing practice valuations throughout Texas and the Southwest since 1974. As independent appraisers, and members of the American Society of Appraisers, you are assured of the highest standards and expertise in developing a fair and impartial opinion of value. We work closely with you, your attorney, accountant and other practice advisors in a team effort to prepare a valuation suitable for each situation. Our objective is to provide you with the highest level of professional appraisal service.

*American Society of Appraisers – Business Valuation Standards

23-Sep-03 2:00 PM