The case of the dead beauty
Not everything always goes well in Forensicland. Sometimes we cross out. In more ways than one.
I was looking out the tall windows of my office at the blue, blue Santa Barbara sky, not a cloud in sight. It was my fifty-something birthday. The bills were ignored. It seemed like a perfect day.
Then the phone rang and a charming voice answered. Ginger Justin. She laughed; she loved my jokes; she thought I was brilliant. She said that I was perfect for her. As an expert. She reminded him of her dad. Her father deceased. She should have taken the sign.
It appears that Mrs. Justin’s father had passed away, possibly with the help of Lynn Dallas, a roommate, a roommate who was listed in the latest version of Dad’s will. Not only that, Ginger, the kind, caring, and charming Ginger, had been cut from the will. Her brothers were still there. Her grandchildren were still there. Mrs. Dallas’s pet was there, for God’s sake! Money for the companion of the companion! But nothing for Ginger.
Something had to be done. The fraud had to be exposed before she took another old man’s fortune. As Ginger informed me, this was Dallas’ modus operandi. She meets the old man, moves in with him, becomes a love interest (“She never loved him; she was just after her money!”), then help him leave the planet when the time was right. Ginger’s legal eagle, Big Dan Tuberosa, competed. “This is a bad woman, this Dallas. She must be stopped.”
So I ordered a catalog of devices that could contain multiple versions of the will. Mr. Justin had a big catch. Racks with networking equipment above and below. Various computers and laptops. Lots of backup hard drives. Ginger asked if she could pick them up at the estate manager, John Geering’s place in Silicon Valley. And if she could reduce the price of this poor heroine.
Thirty years of being in the business has taught me the hard way that when someone tries to manipulate you and deal with you, it’s a red flag. Every dollar of discount seems to come with a decrease of five points with respect. It’s a weird part of human nature that giving away a C bill makes people think you’re an easy target. But his desperate charm kicked in and I said I’d pick up the gear the next time I was there. It turned out that Yahoo! News wanted my input for an interview/online article called: “True/False: Never Sell Your Old Phone,” so after the interview, I went to the nearby Geering digs to look for the stuff.
When I walked down the stairs to his office, there was Ginger, waiting to greet me. She was tall, lanky, and thin, except where she counted. Her flaming red hair was illuminated by the afternoon sun. She leaned into me with a long, languid hug and she asked me to share a beer at a local sidewalk cafe, where we could discuss the case.
I chose a table outside, in full view of everyone, just to play it safe. A local Firehouse IPA cooled my flushed face and calmed my nerves enough to unsettle my wits. The roaring in my ears subsided. I heard more about how much Ginger’s dad loved her. I heard more about how her brothers (the ones still mentioned in her will) trusted her to tell her true story, in memory of her father. I heard Ginger had to do all of this on her own. I heard more about the wicked Miss Dallas. I heard this case would be worth tons of money and couldn’t she pay some of my fee on a contingency basis?
It turns out that expert witnesses are not allowed to work on a contingent basis. The image of the hired gun would be inevitable. Regardless of the circumstances, being paid according to what you earn simply does not fit with the ethic of absolute honesty on the dais. As the Lamas teach, attachment to the result only causes suffering.
We still had to deal with the matter of a contract and an advance. Big Dan assured me that Ginger was good at it, but it’s never a good idea to start without something written. She signed the contract and handed me a check.
With this behind us and some technical talk put into layman’s terms, we decided on a strategy.
She thought that two computers (with 3 disk drives) would be more likely to bear fruit.
• I would, of course, do a forensic image of each of the hard drives, using FTK Imager via a write blocker.
• Perform a keyword search with EnCase for terms and phrases taken from known versions of the will and provide the results as a spreadsheet for each search term.
• Recover deleted files.
• Search for Willmaker documents, including finding a hex signature for those files, then find and sculpt with Blade.
• Find out when and on which computer wills were created, modified and accessed.
• Provide a comprehensive spreadsheet listing of all files with dates created, last written, and last accessed, among other file attributes.
• Unearth all existing and deleted History entries, using NetAnalysis and HstEx
• Find which USB devices were connected to each computer (in case there were more discoverable devices).
• Find out if file cleaning software has been installed.
As you can imagine, it took a bit of time and produced a lot of electronic documentation. This vast amount of data would wipe out a significant portion of the forest if he sent it out as hard copies. That many reams of paper aren’t free, and since I wasn’t working pro bono, the time to print it wouldn’t be free. Facing the reality of having to pay for my time, Big Dan and Ginger agreed to take it as files even though they didn’t want any electronic correspondence to be tracked later. They wanted email communication to be mute on the subject of what we found. The CYA alarms inside began to buzz. More flags began to be raised…
Ginger spent many hours trying to sort through the data. I spent many hours on the phone explaining. She was smart, but her head wasn’t made for spreadsheets, it was for storytelling, and she composed a story that fit her narrative.
When I explained that the data didn’t fit, she asked me in a hoarse voice if she couldn’t make this adjustment to what I thought the data meant. Through more red flags, I had to assume she was kidding me. The data is the data. As a famous TV cop once said, “Just the facts, ma’am.”
The defendant’s attorney agreed to take my statement over the phone. When a lawyer is getting ready to try to dismantle me, I like being able to read his body language, so phone depositions are not my favorite. I could hear Big Dan and Ginger in the room, along with the other attorney. We got into the topic of what the modification, creation, and access dates meant. As I explained, I could hear Ginger asking for a break to check on her son, who said he was home sick.
So my office phone range and number was hers! Her son was fine. She had called to try to change reality a bit. Although she had trouble orienting herself on a spreadsheet, she insisted that I was wrong in my testimony about the dates on the files. I had to explain that I knew a thing or two about them and had done the experiments myself to confirm them. She too, she said, and I was wrong. I have to admit I was a bit nervous. I tried to explain that Windows 7 and XP treat certain dates a bit differently. I had to stick to my guns, and Ginger was furious.
Even so, they decided to take it to court. Ginger prepared a stack of shredded paper spreadsheets and faxed them to me. Now I was the one having trouble interpreting the spreadsheets, since I couldn’t get hers to stay together. I did my best. No one wants a beautiful woman to think that she is being looked down upon.
Then he faxed me about 100 points he wanted me to testify about. I spent more hours explaining that there was so much in there that I just couldn’t say. I felt like I was on a debate team. She should have quit at that point, but I kept going until she said, in writing, that if she couldn’t answer a particular point in a particular way, she insisted that I say she didn’t know the answer. Even if that hadn’t been the height of an ethical breach, it would still be perjury.
I leave.
I called Big Dan and told him that I was withdrawing from the case and that he really should tell his client not to ask a court official for perjury. But Dan still believed in this terrible temptress. And court was looming. I let myself be talked into going to court under the following circumstances: Ginger was no longer speaking to me, only to Attorney Dan; no one would try to influence my testimony, including Big Dan; and had to receive immediate payment to cover the long overdue bill as well as the next testimonial.
Done and done. I quit. I wish the deal would stick.
What should have been a few hours in the booth turned into two full days. Ginger sat with her attorney, frowning, shaking her head, and trying to get me to say the “right” things. Every one of her experts and her lawyer and her judge were fools, and every one of the opposition was brilliant. The breaks were full of accusations and this beautiful woman who could make so many people dance to her music just couldn’t get the facts to say what she wanted, no matter how many times she changed her mind about what they should mean. .
They asked me to stay another day as a rebuttal witness for the next guy, but I just couldn’t. I had to deal with reality and dating.
Well, in the end, I kept the bag for one day’s court billing, and karma caught up with the toxic temptress. Maybe it was her histrionics, her fluent way with the truth, or just that dad had cut him out of her inheritance for some strange reason. But after more years of working in the court system, evil Lynn Dallas ended what Will bestowed upon her, and the cunning siren got a piece of her karma.
So now I sit, brooding over flags and signs and that blue Santa Barbara sky. Paying a little more attention to what the universe has to show a guy who makes his living digging up the truth with a forensic shovel. Trying to see what’s coming before the almighty has to hit me in the forehead with a sledgehammer to get my attention. And keep the fancy duds pressed down for the next court date with the facts.