Emerging Litigation Podcast

Getting Digital Evidence Right with Tim Conlon

• Tom Hagy • Season 1 • Episode 120

Share episode

Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.

0:00 | 57:26

Mobile phones, social media, cloud storage, and email sit at the center of modern fact-finding, but, to their detriment and that of their clients, attorneys often misunderstand or underuse this data. 

Practitioners may not realize that client-provided screenshots are often forensically weak, or that texts and social media can easily be forged or manipulated. That means lawyers and courts need to better understand authenticating, preserving, and challenging electronic evidence. 

In this episode, I speak with attorney and author Tim Conlon about how litigators can be more effective by gaining a deeper understanding of the space where evidence gathering and technology intersect. 

Through case examples—including comparisons of computer and cloud backups, comparing data saved at different points in time, analysis of missing and altered files, and tracking email migrations from official to personal accounts—Tim shows how straightforward digital forensics techniques can expose concealment, manipulation, and institutional failures. 

Tim is a Partner at DarrowEverett where he focuses on complex family court litigation and civil cases on behalf of children abused in the care of others, with particular emphasis on cases where electronic evidence and digital assets play a central role. 

He has handled matters at the forefront of litigation, from computer crime investigations in the 1980s to chairing and resolving Rhode Island’s clergy abuse cases on behalf of dozens of victims. Since the late 1980s, he has used electronic evidence to uncover hidden assets and misconduct, including forcing the division of more than $16 million in cryptocurrency shortly before the 2022 crypto crash. 

Tim is a frequent lecturer on electronic evidence, trial technology, and advanced litigation issues, and is widely published and quoted in national and regional media. He is the co‑author of Electronic Evidence for Family Law Attorneys (American Bar Association, 2017) and is currently completing an ABA book on cryptocurrency and digital assets, continuing his work at the intersection of technology and modern litigation. 

Thanks to Tim for sharing his insights! 

Tom Hagy | Host | Emerging Litigation Podcast

______________________________________

Thanks for listening! 

If you like what you hear please give us a rating. You'd be amazed at how much that helps. 

If you have questions for Tom or would like to participate, you can reach him at Editor@LitigationConferences.com.

Ask him about creating this kind of content for your firm -- podcasts, webinars, blogs, articles, papers, and more. 

Setting The Stage For Digital Proof

Tom Hagy

Today we're going to talk about digital evidence and getting digital evidence right with Tim Conlon. That's what we're calling this. And he's going to join any minute. For all I know, he's already joined, and I'm in the wrong studio. Mobile phones, social media, cloud storage, email, they sit at the center of modern fact-finding, but to their detriment and to that of clients, attorneys often misunderstand it or underuse the data. As examples, practitioners may not realize the client provided screenshots are often forensically weak, or that text and social media can easily be forged or manipulated. That means lawyers and courts need to better understand authentication, preservation, and challenging electronic evidence. In this episode, I'm going to talk with Tim Conlon about how litigators can be more effective by gaining a deeper understanding of the space where evidence gathering and technology intersect. Through vivid case examples, including comparisons of computer and cloud backups, analysis of missing and altered files and tracking email migrations from official to personal accounts. Tim is going to talk about how straightforward digital forensics techniques can expose concealment, manipulation, and institutional failures. He shares insights about how public exposure of digital trails changes the understanding of past misconduct. So Tim Conlon is a partner at Darrow Everett, where he focuses on complex family court litigation and civil cases on behalf of children abused and the care of others, with particular emphasis on cases where electronic evidence and digital assets play a central role. Tim has handled matters in the forefront of litigation from computer crime investigations in the 1980s to chairing and resolving Rhode Island's clergy abuse cases on behalf of dozens of victims. He's also a frequent lecturer on electronic evidence, trial technology, and advanced litigation issues. He's widely published on these subjects. He's author of Electronic Evidence for Family Law Attorneys. That's uh the American Bar Association, and is currently completing an ABA book on cryptocurrency and digital assets, continuing his work at the intersection of technology and modern litigation. So with that, Tim will be joining me shortly. I hope you enjoy the interview. It's an important topic to a lot of attorneys and companies and individuals as well. And uh I appreciate your spending time on this. I I have introduced you already. You've written quite a lot about this, you've got a new book coming out on cryptocurrency and digital assets. And uh and so I'll I'll make sure that people have access to how they can get that. You also wrote uh electronic evidence for family law attorneys, Ben. That was published by the ABA uh a few years ago. So we'll give those a plug and a link. Um but so I guess just to get started, um, we'll start with the big picture of digital evidence and everyday litigation. And you work a lot with family and tort and school abuse and broader civil cases. And um how often does digital evidence, like cell phone data, email, cloud accounts end up at the center of disputes?

Screenshots And Fake Text Traps

Tim Conlon

Well, I don't know about the center, but it is certainly prominent in virtually every case that I've been involved in of late. You know, whether it's because of an email or a text message uh between two spouses or it's a text message from a coach who's trying to set up some rendezvous with a student. Um the bottom line is that since 90% of our communication ... probably more than 90% of our communication flows through our cell phones, um person-to-person communication is pretty much central to uh every case now.

Tom Hagy

Yeah, it's everywhere.

Tim Conlon

And so it's unavoidable. It's unavoidable.

Tom Hagy

Yeah, absolutely. So when people hear about eDiscovery, they're they're picturing, you know, I do, I picture massive corporate email reviews. And um, you know, you talked about even it's in the news. I uh was struck when I heard about you know the Epstein files, you know, however many, three million, it's gonna take forever. And um that seems to be the biggest uh recent case that that's that's been in headlines. But you say that there's a there's a widespread misunderstanding of what digital evidence is. So what what common ways do lawyers and courts get that wrong?

Tim Conlon

Because the clients are, you know, basically consumers, okay, like yourself or myself, if you will, on a day-to-day basis, okay, taking off my lawyer hat and just living a life, okay, they're not looking under the hood and they're not even thinking about digital forensics. They're just clicking a screenshot and sending it to their lawyer because I'm sending you that text he just sent me. Or, you know, well, I yeah, I saved that text. Well, if you you ask them what they mean by save that text, what they mean is they screenshot it. You know, it's like, well, did you delete it from the phone? And and and you can see the eyes glazing over, right? It's like, well, uh, well, I never delete the text. Okay, well, then it's probably still in the phone. But of course, you know, when you scroll up, you'll watch it spin a little bit as it loads, you know, because it's not putting it into RAM for the purposes of feeding it to the screen, you know, all the way back for three years. But you could have text messages going back three years in your phone. You know, they're not thinking that way. Well, I don't know, the text isn't there, and I'm not sure the text is there. Well, they haven't even looked for the text. And if they got it, they're still going to think that when they screenshot it, they're giving you the text. They're not, they're giving you an image of a screen. And you know, I sent you that specific text, you know, fake text, okay. Yeah, yeah. Um, right before we got on. And there's so many ways to play games with texts that when you're only looking at a digital image, a screenshot, you wouldn't be able to see that they're fake. Now, I spelled your last name incorrectly because often that kind of thing will give it away in the sense that somebody who's faking something won't necessarily be careful. There could be a spelling error involved, and so you may be betrayed by it. Um, or it it may betray itself, if you will, because you're looking closely. But if they if they're more careful, then um it's much harder to see. You know, I I think of a case that we were involved in a number of years ago, but the bottom line is that our client had a text conversation with a uh woman that he had a child in common with, okay. And the woman had produced a text conversation between herself and the client, and the client made what appear to be incriminating statements in the text convo. Okay. But what was interesting was if you looked at the text conversation in his phone, right, and you compared it with the text conversation that she produced, there were pieces missing. Okay, so I'm texting you that you can't imagine what Joe got himself into. You're saying what's up. I'm saying, Well, let me tell you, this is what I got from him. Oh, I got so effed up last weekend I crashed my you know, Mercedes. Okay, or or whatever the hell it is the admission, okay. Well, she takes out the you know, Joe got in trouble, right? She takes out the let me tell you what he got I got from him. She just goes to IF'd up last weekend and crashed my Mercedes, okay? Yeah, or or whatever it was that she wanted to attribute to him, and she does this throughout the convo. So all of the stuff that he's reporting to her that his buddy told him or texted him, he's telling her that was texted to him by the buddy, but the part about this is what he said next is all missing. Now, when you count the texts between, because they're all time stamped by your phone, and that will show up in the image, the date and time. But when you count the number of texts in his version of the convo, let's say there's 14 between this time and that time, you count the number of the text in her version of the convo, is let's say seven, a much smaller number, okay? You go back to the provider with a subpoena for the text messages going back and forth. Now you will hear all the time that you can't get the text messages from the providers, which there's truth to that, but you can get logs of text activity. And so you could see that the number of messages that went back and forth between the two of them from his cell phone provider, right, was the same number as the number that we produced. That the number of text messages that went back and forth for her was missing X number, I think you know, I'm saying seven in this example, but he had a specific number that was missing. So you knew that she cooked the books, which, you know, is that in and of itself is is incredibly destructive on so many fronts, right? At that point, her lawyer is just running and looking for cover, right? Because I mean, you you've just got finished having your client say, because of course you bring them in for the deposition, and you ask them questions, and I see you produce these texts, and when did you get these? And is that a complete version of the conversation? And of course, she says it is, because what else is she gonna say, you know? And then you you you go from there. Well, it's kind of funny because look at this one, you know, and and and look he's got 14, you got seven. And and you can watch the the walls closing in, if you will, and then you've got the the the data from the phone company that is showing that 14 messages went, and she only has seven. I mean, it once it becomes apparent that the woman is cooking the books, literally cooking the books.

Tom Hagy

Yeah, yeah.

Tim Conlon

But most attorneys, well, let's start with the clients. Most clients figure that because they screenshot something, and most of them are not cooking the books, by the way. But the bot the problem is that that someone in my position who's not schooled in this can be taken advantage of, you know, and so now you're put in a in a bad position. Um, not to mention it's the screenshots are stupid and a pain in the butt anyway, but from a forensic point of view, they're they're literally useless.

Tom Hagy

Yeah. Is there is there any other data that that comes from the actual text chain? I assume there is, versus just a shot of a screen.

Tim Conlon

Well, let's start with if you were to text me a photo, right, and I get that image file, then that Apple, an iPhone photo will tell you the latitude and longitude at which the the can't the image was taken, it'll tell you the date and time, it'll tell you, you know, a whole bunch of data around the creation of that photo. You ain't getting that out of the screenshot, right? So if I've got a screenshot with the little itty-bitty thumbnail on it, as opposed to the actual image that was transmitted, I lose what I mean, the term is metadata. So you lose the metadata because excuse me, you you lose the metadata because all that you have is the you know, JPEG or whatever is created when you do the screenshot, the image file, uh, which is basically useless from a forensic point of view.

Tom Hagy

And as you demonstrated to me uh before before we uh spoke, you sent me a uh fake text. And so it sounds like it looks like to me like there's a little bit of an industry out there helping people create facts fakes.

Tim Conlon

Absolutely. I mean, they'll they'll have the usual disclaimers, but this is not made to be done. You know, this is just for fun, you know what I mean? But but but there's some people who've got some pretty twisted ideas of fun and and they're using those tools. Um, you know, and but literally uh ifake text.com, I think is the the one that I use to make the example. And they're not a sponsor. All I did literally was I I looked at the the little blurb about some of the topics, and I thought, you know, this will be a hoot. So I just googled fake how do we how do you fake a text? And it got me to IFake. The entire process took less than six minutes prior to me hopping onto this call.

Tom Hagy

And I didn't see it. When you mentioned it to me, I looked at it and I thought, oh, he was joking. Uh because you said uh you said the check is in the mail. I thought you were kidding. I said the check was in the mail. Right.

Tim Conlon

And I said, thanks.

Tom Hagy

Yeah, right.

Tim Conlon

You know, I'm looking forward to that check. But but yeah, I I fake promised, I faked you telling me that you were gonna, you know, send me a check. And and I just is an example of trying to you know show how easy it is to create those foolishness. And then misspelled your name as the sender just because I figured it'd be fun so that you could see you know how easy it is to do.

Tom Hagy

I'll share, I'll share that with everybody, and everybody can go create their own fake text. Basically, I'm not encouraging that by the way.

Tim Conlon

I'm not trying to encourage this behavior. It's just important, your average lawyer, okay, who's busy, right, and has other things to do than forensically evaluate the evidence that their client sends, um, you know, i is is in a in a danger zone to a certain degree because I mean, they get the stuff. They're not doing what would need to be done to to cross-examine it, right? I mean, because and I kudos to co-counsel on this, she spent uh Brenda Riola spent quite a bit of time digging through the text messages and saw that there was a delta or a difference between the text message version from our client, the text message version from the other side. Right. And and she called that to my attention. And I was doing the depot, and I'm like, well, I can I can tell you how that's done. You know what I mean? The other thing, and and this is different than what you saw with the iFake Text. If you go to your phone right now and you take our conversation, because we've had text message exchange between us, and delete one of the things in the conversation, when you pull the text messages from your phone, it'll be missing. Okay. So, so that's actually a bigger problem than the screenshot thing, because here you could go and grab the stuff out of the phone, okay, download all the text messages, and that message would still be gone. Okay. A whole different issue about getting deleted files out of the phone, but all I'm getting at is that you got multiple levels at which stuff can be fudged. This gal was clever enough to figure out that if she just went and did the press down and then did more, she could select specific pieces of the convo and delete it and create a false reality.

Tom Hagy

Um it seems there's a, and I'm sure there are already um ways to quickly compare uh what's fake with what's real. And I think it's uh it's probably even more important these days when you have a president of a country allegedly saying something and it looks very real. It's like, you know, and people are sharing these things, and I've, you know, is as in tune to this as I am. I've been I've been caught. Um, you know, I saw a picture of uh snowfall outside of Moscow, and I thought, wow, they get a lot of snow, and the snow is up to the top of a 10-foot building, and Russians were snowboarding off the top of the building. And I sent it to my daughter who snowboards, she lives in Vermont. She said, Dad, that's AI. I'm like, no. Okay. Well then in my most recent stuff. What's that?

Finding Missing Messages With Logs

Tim Conlon

I said the the AI piece of this is a whole other level of you know, foolish I would say foolishness, but but but the the forgery and or alteration of valid things, you know. I mean, and if you think about it, you go back to the notion of filters, which I mean, what was that? There was a lawyer who was got in trouble appearing on a cat filter uh that was all over the internet in the middle of COVID when when when virtual hearings were going on. But the all a filter is is a real-time form of digital manipulation. And the idea that people are using it to either get rid of wrinkles or or maybe add some hair, whatever the heck they need to do. I mean, that has now mushroomed into what you just described, which is basically creating an entire fake reality.

Tom Hagy

Yeah. Okay. Well, we'll come to that too, because you because you are uh you were doing some you're doing you're writing about this. And um, so so Walcaster, you had told me about a case where you compared back up backups of a computer and a Google Drive and found thousands of missing files.

Speaker 1

Right.

Tom Hagy

So what was what was that process like? Tell us about that experience.

Cloud Backups Expose Deleted Files

Speaker 1

The crazy thing is on one level, it's relatively simple. Okay. Um again, it's about asking questions that people don't ask. Okay. We had asked for there was is a particular former teacher who was involved in what he would term, quote, naked fat testing or fat testing. He would call it fat testing. The media turned on to the fact that it was done with the kids naked.

Tom Hagy

Um and this was to test their the their fat whatever percentage of body fat.

Speaker 1

Well is that what it was? Okay. So not to take us too far afield, but the bottom line is that his official reason for doing what he was doing was to suggest that it was a body fat test analysis or a body fat analysis. Okay. His sworn testimony when this got to the trial stage was that he had had no training that would substantiate that what he was doing was actually part of a body fat test, and it involved getting inappropriately close to boys' genitals.

Speaker 2

Right.

Deletion Logs And Coverups

Speaker 1

Okay. And then the other difficulty for this gentleman is that he also created other interesting tests like puberty tests and flex tests that also involved putting them in interesting positions, shall we say, and then his hands where they didn't belong. Clearly did not belong. But be this as it may, he got canned. We've got civil actions going on behalf of multiple victims of this stuff. Kids who, as 16-year-old wannabe athletes or student athletes, let's say, okay, um, are being conned into getting naked in front of an old guy or an older guy who's then putting his hands where they don't belong. Um and dealing with all the fallout as this becomes obvious to the world that they were had and and the embarrassment and shame, et cetera, et cetera. But be this as it may, we had requested the data from the drive in the computer that this guy was allowed to leave the building with when he was canned, okay? But the bottom line is that we requested uh that that data. It being a Google Drive, there are snapshots of that drive on various dates. I want to be careful because certainly without it having the documents in front of me, I'm not going to be able to be completely accurate about dates. Okay. What I can tell you is that we were clear ultimately that we wanted the backup or the version, if you will, of the Google Drive that. They got or that was created as soon as possible after the machine was recovered, right? Because they ultimately got the machine back from him. And we wanted the Google Drive as it existed, most recently before he knew he had been caught. Okay? So they dragged him off a bus in February of, I don't recall which year, but let's just say for the sake of argument, 2021. But they dragged him off a bus on a specific known date in February of I'm going to say 2021. You could work your way back through Google and find the preserved version of the file that was most close in time to the moment where he knew he was in trouble. Right. You could get the drive as it existed when it was returned. Okay. Because again, if you're a lawyer who's not schooled in how what is a drive today, okay. If you were old back to when I first got involved in computer forensics, a drive was a physical device that resided on a machine. It spun, okay. Today they're all chips, but be this as it may, it used to be it spun. It was a physical device, and it had platters, okay? And you backed it up to external sources so as to not have a problem if you somebody dropped the machine or it got lost. Okay. So that was in the old days. Well, today that's really not the way most computers are working, right? You have a OneDrive. The OneDrive is echoing to a cloud, okay? So, and that cloud, depending upon the configuration of whomever it is that's running your system, okay, may you may not even be able to write to the local machine, other than that it echoes to the cloud, right? You some machines you can, depends on what security has been allowed by the organization that issued the machine. But regardless, the IT people's access to back versions is controlled by the entity that controls the cloud, not by the nut who has the cam, the the computer in his hand. So you can scrub a drive, but you can't stop Google, for example, from maintaining to the extent that it's a Google drive controlled by a corporate entity, whatever it maintains with regards to the prior version. So running the prior version, the one from right before the guy got drugged off the bus, against the one that was on the machine when it was returned, there was a delta of, I believe it was 11,000 some odd files that just didn't happen to be there. You know what I mean? Um, and as anybody who is working in this area, you know, you don't need to be a rocket scientist to know that what's missing is usually the stuff that you're looking for, right? Um, you know, I I I this goes in 80, I'm gonna say it was 87, where I was involved in a prosecution of a financial fraud uh case on behalf of the state of Rhode Island prosecuting somebody who was basically hiding ill illegal mortgages that the agency that he was running was a quasi-public state private entity that did uh low interest mortgages that were supposed to be for first home home, first-time home buyers with moderate income. Okay, and and the interest crisis at the time was what was perceived to be flattening the market. So the government comes up with this first-time homebuyer thing, a public-private entity, uh, Rhode Island Housing and Mortgage Finance. It's run by a guy by the name of Ralph Parry. Ralph was politically connected, and the Providence Journal got a hold of the fact that there seemed to be a whole bunch of people who were politically connected who were getting RIMFAC mortgages, and it didn't make a lot of sense because they didn't seem to be of the income type or they weren't a first home, first-time home buyer, but like what's going on, basically. So the AG went in um with subpoenas for the financial records, including the digital records, and a woman by the name of Susan, um who was an executive assistant to Ralph, um, was being instructed while they're coming in to delete the mortgages out of the system. Okay. But the the two problems, okay. First problem, and Sue was kind enough to make sure that everybody knew this at the AG's office, or the appropriate people knew it, that that the she knew that the system, as a a it being a forensic a financial management system from old school would log deletions. So there was a deletion log. And that deletion log was being updated every time she hit delete, which is time stamped, and it's time stamped during the point where the people are coming in to execute the warrant. Okay. So, and the beauty of it is, of course, Ralph is telling her to delete all the bad mortgages. Okay? So, like, let's hypothetically, there's, you know, 2,800 or or 32,000, whatever the number of mortgages that Rimfic had, the ones that are being deleted are all the ones that they shouldn't have made in the first place. Okay. So if you need to prove that Ralph knew what Ralph was doing, then all you had to do was look at the fact that they just happened to be deleting all the ones that implicated Ralph in doing it. You know what I mean? So, so, you know, that kind of evidence is not just interesting because it shows the the particular mortgages are going missing. It shows that somebody's actively involved in attempting to cover their misconduct, right?

Speaker 2

Yeah.

Speaker 1

And, you know, again, the import of the fact that the woman cooked the books, if you will, as to the text messages, really wasn't about whether our guy had done the stupid stuff that was in the text messages that she was trying to imply he did or didn't do weren't really the focus of the litigation. But the fact that she was choosing to manipulate data so as to create bad image of him really cooked her goose.

Speaker 2

Yeah.

Speaker 1

That would do it. And her lawyer obviously wants nothing to do with any of that. No, no lawyer wants to be in that position. You know, you touched on something, you know, when you said something about what traditionally had been the realm of digital evidence, and then that is and you know, what in part led to that book that you were asking me about or mentioning a minute ago. I mean, you come into digital evidence in the context of 2005 or 2006 or 20, you know, 2010, even. Okay, 99% of that is discussed around large corporations, data processing departments, you know, then you get the mass email, you know, uh discovery stuff, the traditional big firm e-discovery problems, okay. That today is the tip of the iceberg in the sense that of obviously Epstein is a is a large-scale project, okay? But but I'm talking about, you know, garden variety divorces. I'm talking about a sexual abuse case involving misconduct by a coach in school, things that don't screen e-discovery, and yet the reality is that you know, this guy was texting kids about setting up um, you know, the uh little your AI just put a thought bubble with a thumbs up on my screen here because I did this. This guy was texting kids about setting up the fat tests. Okay, well, you know, those become quite useful. You know, he moved email very subtly. You could watch as he would start with an email from you know Tim Conlin at DarrowEverett. or Tconlon at DarrowEverett.com to an email address that wasn't his school email. So it wouldn't even fly to the school server. And similarly, he'd I don't know exactly how, I mean, I could talk to clients about it, but he'd weasel a private email address, right, from the kids, and then he'd get the over time, you could watch the communication go from the equivalent of T. Conlin to some personal email address that I have. And away from your Tom Hagee at the school department. Basically, they were NKSD emails. Okay. So in North Kingstown School, if I recall correctly, North Kingstown School Department, NKSD.net, let's say, okay. So it would go from T Conlin at NKSD.net to some personal email address. It would go from student Tom Hage at NKSD.net, okay, to some personal email that you had. And now all of a sudden that communication is being moved off of um off of the school.

Metadata And Native Files Basics

Tom Hagy

Great. Yeah, gotcha. So to kind of uh step uh back um or step up, I don't know which way I'm stepping, but so so let's uh talk about raising the uh literacy of uh of digital evidence among attorneys. So if you were doing a short uh course for litigators on digital evidence, what what would you say are the are the core concepts they absolutely must understand? And then secondly, are courts keeping up with this?

Speaker 1

Well, the okay, I'll take the second thing first, if you don't mind, just because to the extent that the lawyers are, it it is certainly causing the courts to do so. Okay. Um, but in terms of the first thing, I would say the concepts of quote native files, okay, and metadata, okay. So uh for those who are not familiar with the term, metadata is basically data about data, okay? And metadata in the context of any computer file is material that is stored in the original file. And I'll get to what I mean by that in a minute, but the original computer file accessed by the program that is not necessarily seen by the user. Okay, so just to use Microsoft Word as an example, okay. When you install Word at some point in your preferences, you may well set up that your name is such and such, your organization is such and such, and you know, your initials are TJC. Okay, that data is being associated with every file that you create, along with when you created it, along with when you modified it. Okay. And the reason that, for instance, when your computer crashes or you forget to save something, or you were prompted that there was something that wasn't saved that you want to recover, right, is that that stuff is accessible to the software that Microsoft runs to create these files in background and then can be scavenged for lack of a better term, so as to reconstruct what it is that you are at. But flipping it around, if you open the Word doc, not with Word, but with a forensic software, or for that matter, a text editor, and just look at the file, you can see pieces of data that are stored, just as you can with an eye uh a picture taken on an iPhone, okay? You can see data around where it was created, when it was created, when it was modified, et cetera, et cetera. We are, as lawyers, sometimes lazy or not thinking around the difference between getting the document, okay, which could be produced as a PDF of a Word document, right, and then bait stamped as a PDF versus getting the actual word file. And there's information that you can glean from the word file or from the email that you would not be able to glean from the raw file, from a PDF, which is a picture, if you will, of the file. So understanding the difference between a PDF of a file versus quote the native file and getting native files where you have issues around the forensics of what is going on under the hood is a significant step that lawyers should be aware of.

Tom Hagy

So technically, how do you do that? You you I you kind of said it quickly, I believe, but if I wanted to see the metadata, metadata behind a uh but a Word document or a PDF, maybe.

Website Source Code And Wayback

Speaker 1

I don't want to say that I know all of this off the top of my head with a pop quiz in terms of what the most effective tool is, okay? But you can definitely open most files with what on my you know, I run Mac, so text edit, okay, is I think the name of Mac's generic text editor, okay? Right. And it'll open a lot of stuff. Now, you how much you will be able to read is a different story, okay, because a lot of it is I don't say machine language, but it's encoded in such a way that it means nothing to the naked eye. As to most forms of commonly used uh files, image files, Word documents, there are tools that will allow you to examine the metadata without altering the file. So there are forensic tools that are, apart from just generically being able to open it up and peer into it, there are tools that will allow you to open the file without opening it. You're viewing the file, so you're not altering it, altering it. And they've been specifically structured so as to, for example, read word files and grab whatever metadata is stored with the word file, or the PDF, or the this or that. Each software package is storing different kinds of metadata, right? The programmer, the programmer or the company that wrote the program has the ability to build that in. You can go to a web page, view a source, and you'll see metadata that's there on the web page that is not available to you. I mean, it's it's all available to you, okay? But it's not visible. I'm looking at a web page right now as I'm talking with you. It's showing me Riverside, it's showing me your studio, it's showing me Times, right? It's showing me a bunch of stuff that is what you're seeing only backwards slightly, and you've got some controls, okay? But if I were to view source, I would see a completely different thing, which is what the HTML editor is transferring into. You would always want to get the HTML code. Okay, it's a great example, okay? Get the HTML code on the websites of the entities you're suing. Okay?

Speaker 2

Yeah. Okay.

Speaker 1

Because, like when I'm coming into a school system, you know, and and I come into school systems, you know, hot for a life of a miniature, you know, we've gone on and we've downloaded and there's a tool called Sight Sucker. Again, that's a Mac thing. I'm sure there's wonderful things to do it on PCs, but and I'm not plugging SightSucker. Okay. But all I'm getting at is what it'll do is I type, I, I, what which the the address of you must have a website, right?

Tom Hagy

Yeah, yeah. Litigation conferences.

Speaker 1

There you go. So I could point SightSucker at that, tell it to drill down 12 levels, and it just like points and clicks, and it downloads each HTML file. It remaps it so that it will run on a local drive, so I can basically mimic what would be out on the web. And then I can look to see what changes on your website between yesterday and today. Now, you may nothing might have changed other than, oh, I did an interview with Tim Conley. Okay, but if you're a school department with a problem and a particular teacher, that teacher may get evaporated off that website pretty damn quick. Okay. Yeah.

Tom Hagy

Or or any company trying to make a change.

Speaker 1

Correct. Correct. So going out and grabbing what is the current rev of the when they don't know you're coming, okay? And and and having a version of their website. And then there's you've got the Wayback Machine. I don't know how many people are familiar with the Wayback Machine, but okay, the Internet Archive, are you familiar with this or no? Okay, fine. So, but again, you're working in this area. So we're going to assume that some of the people listening to your podcast don't know what the hell I'm talking about.

Tom Hagy

They won't know. Okay.

Speaker 1

Right. So the Wayback Machine is a throw out to um Sherman and Peabody, some cartoon characters in Rocky and Bullwinkle back when I would actually had hair and was a little touch. Right. Yeah, the Wayback.

Tom Hagy

I forgot about that.

Speaker 1

You forgot all about that part, right?

Tom Hagy

I remember that. I remember it vividly.

Speaker 1

Yeah, now as I said it, it's like, holy moly, guys, right. He's got it. It's the way back. Mr. Sherman. In any event, we'll skip over that part. You can Google it, okay? But in terms of the Internet Archive, which if you Google the Wayback Machine is where you're going to get rot, not to Mr. Sherman and Peabody, but be this as it may, in terms of the Internet Archive, it's, I believe a not-for-profit, that does nothing but scrub, store, and archive and index snapshots of websites. Okay? I'm not certain how they choose who, and I certainly don't know what their frequency algorithm is all about. Okay. I do know that if you wish to arrange with them, I believe for some form of contribution, they will step it up in terms of a particular entity. But be this as it may, you can go to the Internet Archive tomorrow and look at Darrell Everett and or any other entity that's out there on the on the web and then ask it when you got snapshots of that entity. Okay. Okay. And you can then download whatever snapshots it's got. Now, sure, it is not necessarily complete. Okay. It's not like they will take every page off of the North Kingstown School Department's website. So you're stuck with what they happen to shoot on A.

Tom Hagy

Right. Nor will they do it minute by minute.

Speaker 1

No, no, no, that's correct. It may be that there's 10 shots that happened in a six-month period in 2019. You know what I mean?

Speaker 2

Or two.

Speaker 1

And you it'll show you graphically when it has those shots. Um, but you can grab those. When you grab them, you grab original HTML. So if you open it with with at least again, I'll go with Apple's universe, Safari, you've got to put yourself into developer mode. And then you can turn on the the ability to see the source code as opposed to actually just get a functional, I mean it'll function, but but if you w view it as source code, then you can look at what they had for metadata.

Tom Hagy

Yeah, there's a lot of lot of data behind these websites. And I I use I have used it for um uh what was I doing? I was working With another company, and I was doing webinars for them. And I needed to have to tell my people how to get to that webinar. I had to have a special ID for that webinar. And the company was very slow in getting it for me. Um, and so I would just I would just go on. You go on Chrome, you go view, as you said, you go down to developer, and you can say view source, and it shows you all the metadata. And then I figured out, oh, they bury the ID way down in line 542 or something. So I'd anyway, so I I did learn to use it for that reason, but there is, you're right, it's just page after page after of data.

Speaker 1

Right. So the amount of stuff that's out there is astounding, right? It's really more a question of shifting your mindset to from where you used to be, which is you're a consumer looking at stuff, and you know, I go to a website and what they show me is what I'm seeing, versus someone who's looking under the hood, right? Turning on the source, you know, looking at the source and seeing the code that's behind it, which is flat out there in the open, okay, and and pulling the data that they're not intending that you see.

Bad Redactions And Hidden Text

Tom Hagy

Yeah. Right. Yeah. And this uh and this other thing came up, and I don't know if this is metadata or what it is, but I was trying to help a firm find uh language of a of an agreement in a court case. And I found the files where they discussed it, but they heavily redacted that specific language. So I took the PDF and I just copied the redaction and I pasted it into text edit, and it revealed what was behind the redaction. And this just came up again uh in the news, big time.

Speaker 1

Okay. So we're all on the same page in terms of people listening to this. There are redaction tools that will obliterate the data that you were able to reveal. Okay. There are also people doing redactions that are not redactions. Correct. Okay. And and so, yes, you know, if you put a black block over something, the thing that you put the black block on is there.

Speaker 2

Yeah.

Speaker 1

And that's not a redaction. Okay. Um, but again, it's it's all about looking not at what the program just chooses to show you, right? Because if you open the thing in a PDF viewer, you're going to see the black block that somebody put on top of the text. That's like, you know, it from a technical point of view, there's an image, there's some text, and somebody put the image over the text. So it's going to recreate it exactly like it's supposed to. The image will be over the text. Well, okay, great. But the text is still there. And if you you copy and paste, you'll get the text. Um, there's other ways of getting behind that, you know, if if somebody's foolish enough to do it that way.

Tracking Hidden Crypto And Dividing Risk

Tom Hagy

Trevor Burrus, Jr.: Well, this recently came out, and uh, I don't know if I can't remember which case it was. It might have been the Epstein case, but there were uh significant redactions, as everybody knows. But somebody was able to uncover it by doing exactly what I did. I thought I discovered it, but maybe it's you know, other journalists have been using it. But I do want to get to um, you know, while we have time now, I misspoke earlier and said you're writing about artificial intelligence and data and digital. I meant to say what you're writing about.

Speaker 1

Yes. Okay. Well, we've wanna but go ahead.

Tom Hagy

Well, I just want to give you, you know, uh an opportunity because you've got a book coming out also on uh crypto. So you've handled litigation in these high conflict cases, high conflict cases where digital forensics and crypto have come into play, including one in which you rec recovered quite a bit uh of money in uh in hidden crypto.

Speaker 1

So tell us about that and what what lessons that you might share with other attorneys about which you for one, it doesn't make sense to use, and I I'll just use the Rhode Island uh forms, if you will, as an example, but standard forms that are not looking for digital assets are are just woefully incomplete, is really what it comes down to. Because whether it's a Venmo account, which I most people wouldn't conceive of as crypto in the normal sense of the word, but it is certainly electronic currency, okay, that is moved and money moves through it, okay, or it's you know, Bitcoin or any of the other digital wallets that are out there. Um, you know, it's become quite popular, number one. And number two, it's potentially quite lucrative. And it's also, on the one hand, incredibly transparent when you have access, but if you don't have access, is is easily covered. Um so the idea that you would just ignore digital currencies is certainly not a smart idea if if you're a family law attorney. And then the question becomes how do you you divide it? How do you you force its division, um, which you know we were able to get a court to do. And um, and I'll just drop a little suggestion here, okay? If you because normally the problem in my area, in the family law area around the digital currency, is that you have one spouse who's like in like deeply embedded tick around the crypto market stuff, and you've got another spouse who's basically not interested or clueless, not because they're stupid or anything, but just it became a hobby for somebody, and the person it became a hobby for, okay, is in this 24-7. The other spouse only knows that they put some money into crypto. Okay. So, so there's the disparity in information, and and I would just using that case as an example, reference that the person who had control of it was not exactly forthcoming in terms of dividing the stuff. There would just seem to always be a problem getting it done. So the the quick hint I'll throw out there is that we got an order entered that said that to the extent the mat that the crypto wasn't in fact divided by such and such a date, the risk of loss, it didn't use the term risk of loss, but what it said is the value as of that date, he owed her, period, and it's one half of. Okay. If the market went up, she got the up if the market went down, not her. Once you shifted the market risk unilaterally to the person in that instance it was the guy, but to the guy who controlled the coin, he he wanted that stuff divided as quickly as possible.

Tom Hagy

Right, gotcha.

Speaker 1

Right. Because they were nowhere longer in a position where he was effectively gambling with her money. Because he knew perfectly well that the court was going to divide it 50-50. And if he left it in there, which he had the appetite around risk, evidently, that it and it went down, she got less money. If it went up, there was more. And he liked playing. So therefore he did.

Tom Hagy

Well, how did you find that he had it? Was it a matter of you just asked and then got an order, or was there evidence suggesting that he had it?

Speaker 1

So I I candidly will not be able to recall exactly how we found the first sniff of it. Okay, but I can tell you that you see transfers of funds out into the investments. Okay. And once you've got the fact that there are transfers out, you get court orders that the guy give you snapshots out of digital wallets. And ultimately we brought basically a financial advisor who managed crypto funds for our client into a room with the guy and his lawyer, and we monitored the movements out of the crypto accounts in real time as they went from you know, uh just making it up a hundred dollars in Bitcoin, you know, in this wallet, to fifty dollars in Bitcoin in that wallet. So the client created their own wallets that all had you know values of zero with the same providers that the money was at. We moved the stuff, you know, and and watched it in real time, ultimately. You know, but the key, frankly, in terms of getting it done, was the order that basically shifted the risk of loss over to him. Because at that point, he had no appetite for, you know, it was going to cost him if it went down, so he didn't want it to remain in his unilateral control. But honestly, it I think it was probably six months of wrangling to get to the point where that was that order. Now, as it worked out, it had gone up during that period of time, right? But but had it gone down, it would have been a problem. And the client had the right to make control over half of the stuff and no ability to do it because it was all held under his, you know, control. Yeah, yeah.

Tom Hagy

Yeah. So it sounds like to me like there was a thread sticking out, and you guys pulled on it and pulled on it and pulled on it and got a court order, correct? So that's right. Okay.

Closing And How To Connect

Speaker 1

Once you pry open a little bit, getting the rest of it, you know, I in another case we had gotten, then it goes back to like 2006 or some ridiculous, you know, from today's point of view, technology, but we'd gotten um backups of either a BlackBerry or a Palm Pilot, some ancient device that was rumored to have existed in those days, you know. And we were able to pull Excel spreadsheets that the guy had stored on CD-ROM backups of a PC. And we got emails back and forth with account holders. We got screenshots, okay, uh, or images of of things that the guy viewed out of the cash on like somebody goes on to you know, Bancofamerica.com, there's cash files on your computer that show what you were looking at, okay. So between the Excel files, which documented in that instance 24 million, okay, versus because he had net worth what he called the net worth statement on his computer in Excel, right, with 24 million. We had his financial disclosure form with the court that disclosed, I believe, was eight and a half. So I you don't need a I'm not a mathematician, but yeah, yeah, yeah, yeah. You know, so so you know she winds up with 55% of 24. Uh it could have been 25, but 24 in change, let's say, okay. But she winds up with 55% of 24 in change instead of 50% of what was originally disclosed or you know, gotten without the benefit of the electronic discovery. And he picks up the tab for the computer forensics, he picks up the tab for us going in and doing what we did. So, you know, from her point of view, it's a win. Um, and from his point of view, it it's you know, well, she said she wasn't interested in that stuff. He just pawned that off by saying it was uh speculative, which it was, you know, but it was also generating a mass quantities of income. Um, and he didn't bother to mention that. So he felt because she said that she wasn't interested in these speculative things that might have calls associated with them, and you know, and she got half of you know bumping on 10 mil. So I mean it wasn't like she was in a hurt and position, but but it clearly was not equitable.

Tom Hagy

The Emerging Litigation Podcast is a production of critical legal content, which owns the awesome brand HB Litigation. What we do is simple. We create content that's critical on legal topics for law firms and legal service providers. That kind of content can be blogs, papers, it can be podcasts, webinars. Once again, I'm Tom Hagey with Critical Legal Content and HB Litigation. If you like what you hear and you want to participate, give me a shout. My contact information's in the show notes. Thanks for listening.