Case Studies

FDR undertakes and supports a wide range of digital investigationson behalf of our clients, including:

Download PDF versions of more detailed case studies on Intellectual Property Theft and Incident Response.

Case Studies: Legal Firms

• Law firm requested FDR’s assistance with the execution of an Anton Piller order on-site in a case involving suspected copyright infringement by a software vendor. Previous legal rulings against the software vendor had resulted in court orders against the suspects to no longer offer the victims software for sale. FDR experts were tasked with searching for evidence of breach of that order as well as any additional evidence that would support financial loss damage recovery. The software vendor leased two separate properties and operated in excess of 97 computers, several servers and several large RAID arrays. Evidence of electronic sales records and financial data was located, preserved and provided to the independent solicitor and bailiff for disclosure to the court.
• FDR expert contracted by the solicitor for an industrial firm to resolve an issue as to the origin of a specific digital forensic artifact after two other computer forensic experts could not agree on its origin. Detailed, in-depth analysis by the FDR expert identified errors in both previous computer forensic expert reports, as well as a previously undiscovered bug in the forensic software used in the previous analyses. The FDR expert was then able to conclusively resolve the dispute as to the origin of the data.
• FDR engaged by international law firm to forensically image two computers and extract relevant data to determine the existence of solicitor-client privileged material, prior to releasing the material to a government agency as part of a securities investigation. Data was provided in a timely matter and was more complete than data derived from the same drive by another government agency.
• FDR engaged by a large law firm to assist with the writing of Affidavits and court applications for the E Discovery for an ongoing case.

Case Studies: Commercial Firms

• FDR engaged to examine a computer in relation to an employee who left the client’s company to work for a competitor several months earlier. Numerous documents and emails related to the competitor were located, extracted and supplied to the client. A list of the removable storage devices used as well as a timeline as to when they were used was also supplied. The examination also revealed weaknesses in the client’s handling of corporate data and computer use policies.
• FDR forensically compared two databases belonging to former business partners and established (through forensic artifacts) that one partner had copied the company’s proprietary customer data.  The partner subsequently used the customer data to start up his own competing business.
• Before leaving his job at a large corporation, a systems administrator changed all the administrative passwords on the corporate infrastructure. FDR provided remote assistance to crack the passwords so that the new administrator could gain access to the system.

Case Studies: Government Agencies

• FDR retained to examine a variety of computing devices for evidence of fraudulent documents including specific letters and graphics associated to these letters. Devices examined included computers, a cell phone and an electronic typewriter. Forensic examination of the computers found documents of possible intelligence value, but not the specific documents in question. Forensic examination of the cell phone located two of the graphics used in the suspect documents as these images had been saved to the memory card contained in the cell phone. Forensic examination of the typewriter found that the typewriter backup battery had failed and as a result apparently all data had been lost. However, forensic examination of the typewriter ribbon determined it was a mylar one time use ribbon and therefore all of the text that had previously been typed on the typewriter had been preserved on the ribbon and was therefore readable. All text on the ribbon was photographed and then transcribed to a readable format that confirmed the origin of the documents in question. This case is proceeding with criminal charges based upon the data recovered from the typewriter ribbon.
• FDR engaged to locate specific pictures on two computers as well as other evidence in support of charges under a federal act. FDR analysis located the pictures of interest and found email indicating suspect had prior knowledge that his actions were illegal.

Case Studies: Intellectual Property Theft

• In a case of intellectual property theft worth tens of millions of dollars, FDR assisted with the execution of an ex-Parte US District Court order which recovered 16 personal computers, two servers, 300 CDs and 150 floppy diskettes. Forensic analysis confirmed the presence of the proprietary software and resulted in an expedited settlement as well as the identification of other suspects elsewhere in North America. FDR was again retained to participate in the execution of other US court orders, resulting in the seizure of 30 PCs. Once again, FDR confirmed the presence of the proprietary software.
• In a trade secrets and copyright violation case, FDR provided expert testimony critical to the successful outcome for FDR's client in California District Federal Court.
• In a U.K.-based phishing scam, FDR forensically examined a compromised server and recovered evidence of a fraudulent website that had been set up on the server. FDR provided complete documentation of the mechanism by which the phishing scam was carried out and the online identity of the recipient of the personal information scammed from the website.
• FDR assisted with the recovery of three years of email messages that had previously been deleted and were now the subject of a multi-million-dollar civil lawsuit. FDR successfully recovered over 100,000 messages, many of which were pertinent to the lawsuit.

Case Studies: Insider Threats

• An employee of a large corporation was suspected of inappropriate computer use including online stock trading. FDR's timeline analysis confirmed this activity and demonstrated that the only time the person was not actively stock trading was during coffee and lunch breaks.
• A Crown corporation called in FDR to forensically examine the PC of an employee suspected of compromising the corporate network and cracking password-protected confidential documents and files. FDR confirmed the presence of password cracking software and surfing pornographic websites. The employee lost his job.
• A law firm retained FDR to conduct a forensic acquisition and analysis of a notebook PC suspected of being used to facilitate the distribution of illegal drugs and sexually-explicit materials between employees. Suspicions were confirmed and the employees were fired.
• FDR covertly installed key logging software in order to determine if one partner in a professional practice was intentionally manipulating billing codes to defraud his partner. Surveillance confirmed these activities and led to a substantial compensation settlement.
• Another covert forensic acquisition and analysis involved a senior employee suspected of running another business on his PC. FDR confirmed the activity as well as a number of significant weaknesses in the employer organization's computer use policies. The employer was able to use the recommendations made by FDR to improve their computer use policies to further prevent any future incidents.

Due to the sensitive and highly confidential nature of our services, we do not publish client lists or share any information about our clients without their expressed consent.