A recent civil case we supported reminded me of the difference between a cursory technical analysis and a full forensic analysis of a digital device. The issue in question was whether evidence of mass file deletion was evidence of malfeasance. Opposing counsel’s “expert” said it was, we disagreed.

Our Initial Analysis

In this case, we were working with an attorney whose client was accused of having many files that he was not supposed to have on his computer. The computer was placed under a preservation order by the courts, and he was prohibited from deleting any files on his computer.

We were asked to perform a forensic analysis of the computer to look for any files that the person wasn’t supposed to have or for any evidence that he had deleted files. Our examination turned up nothing of interest and no evidence that this person had deleted any files.

Opposing Counsel’s Expert Disagrees

On a Sunday night, after we had done our examination, we received a frantic call from the attorney. Opposing counsel’s forensic computer expert had written a report stating that he had found considerable proof that “hundreds of files” were deleted. Our client emphatically maintained that he had not deleted anything, so we reassured him that we would look into the report from the opposing expert.

The opposing expert stated that he had found an “evidence eliminator” that was used to destroy hundreds of files. We were shocked; our senior examiner had done a thorough examination and had found no evidence of malfeasance. We felt confident that our client had not deleted any files, and quickly returned to our lab re-open the case.

Upon Further Analysis – The Whole Truth

The first thing our examiner found was there were indeed around seven hundred files that had been deleted. How could we have missed that? We then looked for a file mentioned in the opposing expert’s report called, “SymEraser,” and to our astonishment there it was, as we say in Texas, “Bigger than Dallas!” Wow, we started to doubt our findings. Before losing all hope, we quickly ran a Google search for “SymEraser.”

It turns out that “SymEraser” is a file included in Norton Antivirus, Symantec Antivirus, and various other Norton and Symantec packages that include antivirus software. It is not an “evidence eliminator”, it was a virus eliminator. OK, that’s not too bad, but what about all those files? There were definitely hundreds of deleted files. We re-examined them. They were all deleted from a folder called “virdef.” They were in fact, virus definition files. Our client had not deleted them; Norton Antivirus had deleted them when it had updated the computer to a newer set of definitions! This was not the blatant act of a human malfeasance, but rather an automatic function of a piece of software.

We had done our forensic examination, and had not found anything malicious or suspect. Opposing side’s expert had done his examination, and had found quite a lot. So what was the truth? The truth was that files were deleted during a time that our client was not supposed to delete files. The truth was that there is a software program called SymEraser, which eliminates things. That was the truth. Fortunately for our client, it was not the whole truth!

If you’re in need of digital forensics support for a case involving IP theft, family law or criminal law, contact Flashback Data today. We’re the first private digital crime lab accredited under the same program as the FBI. We’ve helped hundreds of attorneys to preserve, analyze and understand the digital evidence in their case.

CALL 1-866-786-5700 TODAY FOR A FREE CONSULTATION

THIS POST WAS UPDATED AND REPOSTED IN 8/7/18