The case of the dead beauty
Not everything always goes smoothly in Forensicland. Sometimes we cross ourselves out. In more ways than one.
I was looking out the tall windows of my office at the blue, blue Santa Barbara sky, not a cloud in sight. It was my fifties birthday. Bills were ignored. It seemed like a perfect day.
Then the phone rang and a lovely voice answered. Ginger Justin. She laughed; she loved my jokes; she thought i was brilliant. She said that I was perfect for her. As an expert. She reminded him of her dad. Her father deceased. She should have taken the cue.
It appears that Mrs. Justin’s father had passed away, possibly with the help of Lynn Dallas, a roommate, a roommate who was listed in the last version of Dad’s will. Not only that, Ginger, the kind, loving, lovely Ginger, had been cut out of the will. Her brothers were still there. Her grandchildren were still there. Mrs. Dallas’s pet was there, for God’s sake! Money for the companion’s companion! But nothing for Ginger.
Something had to be done. The phony had to be exposed before she took another old man’s fortune. As Ginger informed me, this was Dallas’ modus operandi. She meets the old man, moves in with him, becomes a love interest (“She never loved him; she was just after her money!”), then helps him leave the planet when the time was right. Ginger’s legal eagle, Big Dan Tuberosa, competed. “This is a bad woman, this is Dallas. She must be stopped.”
So I asked for a catalog of devices that might contain various versions of the will. Mr. Justin had a big trap. Racks with networking equipment above and below. Several computers and laptops. Lots of backup hard drives. Ginger asked if she could pick them up at the estate manager, John Geering’s place in Silicon Valley. And if she could reduce the price of this poor heroine.
Thirty years of being in business have taught me the hard way that when someone tries to manipulate and deal with you, it’s a red flag. Every dollar off seems to come with a five point decrease from that. It’s a weird part of human nature that giving away a C bill makes people think you’re an easy target. But his desperate charm kicked in and I said I’d pick up the kit next time I was there. It turned out that Yahoo! News wanted my opinion for an interview/online article called: “True/False: Never sell your old phone”, so after the interview, I went to the nearby Geering excavations to look for the stuff.
When I came downstairs from his office, Ginger was there, waiting to say hello. She was tall, lanky, and skinny, except where she counted. Her flaming red hair was illuminated by the afternoon sun. She leaned into me in a languid, enduring hug and she asked me to share a beer at a local sidewalk cafe, where we could discuss the case.
I chose a table outside, in full view of everyone, just to play it safe. A local Firehouse IPA cooled my flushed face and calmed my nerves enough to unsettle my wits. The roaring in my ears subsided. I heard more about how much Ginger’s dad loved her. I heard more about how her brothers (the ones still named in her will) trusted her to tell her true story, in memory of her father. I heard that Ginger had to do all this alone. Heard more about the wicked Miss Dallas. I heard this case was going to be worth tons of money and couldn’t she pay part of my fee on a contingency basis?
It turns out that expert witnesses are not allowed to work on a contingency basis. The image of the gun-for-hire would be inevitable. Regardless of the circumstances, getting paid according to what you make just doesn’t fit with the ethic of absolute honesty on the bench. As the Lamas teach, attachment to the result only causes suffering.
We still had to deal with the matter of a contract and an advance. Big Dan assured me that Ginger was good at it, but it’s never a good idea to start without something written. She signed the contract and handed me a check.
With this behind us and some tech talk put into layman’s terms, we decided on a strategy.
She thought that two computers (with 3 drives) would be more likely to pay off.
• I would, of course, do a forensic image of each of the hard drives, using FTK Imager via a write blocker.
• Perform a keyword search with EnCase for terms and phrases taken from known versions of the will and provide the results as a spreadsheet for each search term.
• Recover deleted files.
• Search for Willmaker documents, including finding a hex signature for those files, then search and sculpt them with Blade.
• Find out when and on what computer wills were created, modified and accessed.
• Provide a comprehensive list via spreadsheet of all files with creation, last write, and last access dates, among other file attributes.
• Unearth all existing and deleted History entries, using NetAnalysis and HstEx
• Look up which USB devices were connected to each computer (in case there are more discoverable devices).
• Find out if file cleanup software is installed.
As you can imagine, it took a bit of time and produced a large amount of electronic documentation. This large amount of data would remove a significant part of the forest if he sent it as hard copies. That many reams of paper are not free, and since I was not working pro bono, the time to print it would not be free. Facing the reality of having to pay for my time, Big Dan and Ginger agreed to take it as files even though they didn’t want any electronic correspondence to be traceable later. They wanted email communication to be mute on the subject of what we found. The CYA alarms inside began to buzz. More flags began to be raised…
Ginger spent many hours trying to sort the data. I spent many hours on the phone explaining. She was smart, but her head wasn’t made for electronic spreadsheets, it was made for storytelling, and she composed a story to fit her narrative.
When I explained that the data did not fit, she hoarsely asked me if she could not make this adjustment to what she thought the data meant. Through more red flags, I had to assume she was pulling my leg. The data is the data. As a famous TV cop once said, “Just the facts, ma’am.”
The defendant’s attorney agreed to take my statement over the phone. When a lawyer is getting ready to try to dismantle me, I like being able to read his body language, so phone depositions are not my favorite. I could hear Big Dan and Ginger in the room, along with the other lawyer. We got into the topic of what the modification, creation and access dates meant. As I explained, I could hear Ginger call a break to check on her son, who said he was home sick.
So my office phone range and number was hers! Her son was fine. She had called to try to change reality a bit. Although she had trouble navigating a spreadsheet, she insisted that I was wrong in my testimony about the dates on the files. I had to explain that I knew a thing or two about them and had done the experiments myself to confirm them. So was she, she said, and I was wrong. I have to admit I was a bit nervous. I tried to explain that Windows 7 and XP treat certain dates a bit differently. I had to stick to my guns, and Ginger was furious.
Even so, they decided to take it to court. Ginger prepared a stack of shreddable spreadsheets and faxed them to me. Now I was the one having trouble interpreting the spreadsheets, since I couldn’t make hers stick together. I did my best. No one wants a beautiful woman to think that she is being looked down on.
Then he faxed me about 100 points he wanted me to testify about. I spent more hours explaining that there was a lot in there that I just couldn’t say. I felt like I was on a debate team. She should have given up at that point, but I kept going until she said, in writing, that if she couldn’t answer a particular point in a particular way, she insisted that I say that she didn’t know the answer. Even if that wasn’t the height of an ethical breach, it would be perjury.
I leave.
I called Big Dan and told him that I was withdrawing from the case and that he really should tell his client not to ask a court officer for perjury. But Dan still believed in this terrible temptress. And the court was coming. I let them talk me into going to court under the following circumstances: Ginger wasn’t talking to me anymore, only attorney Dan; no one would try to influence my testimony, including Big Dan; and had to get immediate payment to cover the long overdue bill as well as the next testimonial.
Done and done. I quit. Hopefully the deal will stick.
What should have been a few hours at the booth turned into two full days. Ginger sat with her attorney, frowning, shaking her head, and trying to get me to say the “right” things. Every one of her experts and her lawyer and her judge were chumps, and every one of the opposition was brilliant. The breaks were full of accusations and this beautiful woman who could make so many people dance to her music just couldn’t get the facts to say what she wanted, no matter how many times she changed her mind about what they should mean. .
They asked me to stay another day as a rebuttal witness for the next guy, but I just couldn’t. I had to deal with reality and dating.
Well, in the end, I kept the bag for one day’s court billing, and karma caught up with the toxic temptress. Maybe it was her histrionics, her fluidity with the truth, or just that Dad had cut her out of her inheritance for some strange reason. But after more years of working in the court system, evil Lynn Dallas ended what Will bestowed on her and the cunning mermaid got a piece of karma from her.
So now I sit, meditating on flags and signs and that blue Santa Barbara sky. Paying a little more attention to what the universe has to show for a guy who makes his living digging up the truth with a forensic shovel. Trying to see what’s coming before the almighty has to hit me on the forehead with a mallet to get my attention. And keep the fancy rags pressed for the next court date with the facts.
