Computer Forensics and E-Discovery Blog

December 9, 2012

Cell Phone Forensics – Pin Locked Phones and Chip-Off Forensics

Posted by Computer Forensics LLC @ 14:50

The Trayvon Martin murder case will be getting additional media attention as George Zimmerman is scheduled to go on trial this summer. CFLLC was recently contacted to provide some insight, as to how potential evidentiary data contained on Trayvon Martin’s phone, might be recovered. The Orlando Sentinel interviewed Dave Kleiman to determine if any additional analysis could be performed on the phone, as the FDLE had suspended their examination, not being able to unlock the phone with a PIN. During the interview several methods were discussed, including the “chipoff” method as a possible means to recover the data from the phone. CFLLC has utilized this technique with notable results, although as was mentioned in the article, it renders the phone inoperable and useless for any additional analysis. The idea that evidence is destroyed in a criminal case may seem objectionable, but experience in other criminal cases demonstrates that it isn’t uncommon for DNA testing or latent fingerprint removal to basically “destroy” the evidence being analyzed. The key is, as in any scientific procedure, to document the methodology and purpose behind any action taken. Doing so, even if it results in modification, or destruction, might well be defensible, albeit not desirable. Does the end justify the means? To assist a jury in their responsibility to render an impartial decision, probably so…
Orlando Sentinel News Article

July 9, 2012

Florida Rules of Civil Procedure – New E-Discovery Amendments go into effect September 01, 2012

Posted by Computer Forensics LLC @ 14:07

The Florida Supreme Court approved the Amendments to the Florida Rules of Civil Procedure affecting E-Discovery, they go into effect on September 01, 2012 Florida Supreme Court Decision

The long awaited decision makes amendments to seven of the existing Florida civil procedure rules:

  • 1.200 Pretrial Procedure
  • 1.201 Complex Litigation
  • 1.280 General Provisions Governing Discovery
  • 1.340 Interrogatories to Parties
  • 1.350 Production of Documents
  • 1.380 Failure to Make Discovery; Sanctions
  • 1.410 Subpoena

The new section of RULE 1.340 (c) INTERROGATORIES TO PARTIES and 1.410 (c) SUBPOENA For Production of Documentary Evidence, have new paragraphs indicating forms for producing electronically stored information. It is suggested that the items be produced in a form or forms in which they are ordinarily maintained, what is sometimes called native format, we submit that this may give you exactly what you ask for, but not necessarily what you want. We recall working on a case for a client where the request for production had already been made before our assistance was enlisted, the request asked for native format of a customized database. The only possible way to review this database was with the native software package, which cost more than $70,000. We promptly suggested the client amend the request and ask that the whole database be preserved, and they specifically detail their requests for the various financial reports needed for review.

July 1, 2012

Proposed Amendments to the Florida Rules of Civil Procedure

Posted by Computer Forensics LLC @ 08:33

We recently had a discussion with a client regarding the proposed changes to the Florida Rules of Civil Procedure, and of the amendments that have been approved by the Florida Bar Board of Governors, awaiting adoption by the Florida Supreme Court. Of interest to our discussion was the federal requirement of meet-and-confer (FRCP Rule 26), particularly, that the Florida e-Discovery subcommittee overwhelmingly voted against imposing such a requirement in the state rules. While noting that early, meaningful, and reasonable cooperation and communication among parties is valuable, the committee drafted the rules so as to encourage, but not require, these discussions. The compelling reasons provided were, in part, to keep discovery reasonable and cost-effective, to prevent the cost and burden of e-Discovery from being outcome determinative, and to avoid unduly favoring either requesting parties or responding parties.

While a mandatory meet-and-confer rule could cause delay in some matters, the reality of our experiences is that in an adversarial matter, spoliation can occur while parties are “voluntarily” discussing issues related to production. While the motive behind this proposed rule is sensible, the application may in fact be problematic. The court, of course, can dictate what actions should occur, and if malfeasance exists, how it might be handled. This could be a non-issue, if the parties are willing to participate within the spirit and the letter of the law, but where the potential for abuse exists, it is likely to occur. Would a mandatory meet-and-confer be of value? The subcommittee held otherwise.

Additionally, the notion that the cost and burden of e-Discovery can be outcome determinative is viable. We have seen vendor invoices from ESI productions that are onerous, and from our prospective inflated, given the methodology used. While the amount of ESI should dictate the cost, the deepest pockets often have an advantage. Is this surprising? Is this really any different that other aspects of litigation? No, not really.

Make no mistake, the proposed changes are welcomed. ESI is ubiquitous and the Florida Rules need to address the realities facing the courts regarding the frequency, the discoverability, the retrieval, review and production of ESI. Done in a thoughtful manner, everyone benefits.

To review the proposed Rule Amendments or to view the Florida Rules of Procedure visit Florida Bar Resources

June 2, 2012

Computer Forensics LLC starts a blog

Posted by Computer Forensics LLC @ 19:53

We are starting a new blog on matters surrounding computer forensics and e-discovery. The is the second post in the blog, we uploaded an old post Outstanding Data Recovery Experience by Dave Kleiman to test the system. However, the original post was created on Feb.25, 2009

Outstanding Data Recovery Experience

Posted by Computer Forensics LLC @ 19:00

A few months back I had the outstanding pleasure of attending a Data Recovery class put together by Scott Moulton from If you have ever popped a hard drive cover off a “dead” drive in the past, just to see what is what, you may have unknowingly opened a recoverable drive.

My favorite kind of classes are “Tools and Tricks” styles, while this class covers much-much more it definitely provided a bucket load of cool tricks for the trade. One of things I quickly learned was those of us who thought we knew all of this, are the ones who were surprised that we learned the most. Now from reading about Scott’s class I thought it would have minor worth in the Forensic field, but as each day went by I found ways to apply what I learned to the forensic process. If nothing else, about 70% of drives I used to send out for recovery, I now was comfortable recovering on my own. Additionally, Scott took the time to demonstrate the various tools and techniques for successfully removing of HD passwords, which is claimed to work with about 90% of modern hard drives. Now I personally know I see requests for help with HD passwords at least once a week on the LE lists such as IACIS. This alone to me was worth the price of the class, and makes me think this would be an excellent advanced course for the annual IAICS training. (more…)

Contact Us by Email:


Contact Us by Phone:


Office Address:

Computer Forensics LLC
1880 North Congress Ave. Suite 333
Boynton Beach, Florida 33426

For most engagements, available travel fee free in West Palm Beach, Miami-Dade, Fort Lauderdale-Broward, Stuart-Martin, Port Saint Lucie, Fort Pierce, Treasure Coast, and Vero Beach-Indian River Florida

See our Subject Matter Experts national news television appearances NEWS
Locate our Computer Forensic Expert Witnesses in FindLaw's Case Law section

Download Computer Forensics LLC's Training Files

Security News Ticker