Which Telecoms Store Your Data the Longest? Secret Memo Tells All

The nation’s major mobile-phone providers are keeping a treasure trove of sensitive data on their customers, according to newly-released Justice Department internal memo that for the first time reveals the data retention policies of America’s largest telecoms.

The single-page Department of Justice document, “Retention Periods of Major Cellular Service Providers,” is a guide for law enforcement agencies looking to get information — like customer IP addresses, call logs, text messages and web surfing habits – out of U.S. telecom companies, including AT&T, Sprint, T-Mobile and Verizon.

To download the document, click here:  http://www.wired.com/images_blogs/threatlevel/2011/09/retentionpolicy.pdf

To read the article, click here: http://www.wired.com/threatlevel/2011/09/cellular-customer-data/

New Mobile Phone Spy Software

SpectorSoft, the company that produces keylogging and monitoring software for Windows PCs and Mac computers has just released a mobile phone version of their software. The new mobile phone software purportedly works on Android smartphone devices and on Blackberry devices. SpectorSoft claims that the Android version will monitor and report on SMS/Text messages, GPS Location, Web History and Voice call logs. The Blackberry version will apparently monitor and report on SMS/Text/MMS messages, GPS Location, Email activity, Blackberry Messenger/PIN Messages, Instant Messages, and Voice call logs. Both versions will also send a copy of all photographs taken by the devices, and allow the person who is monitoring the phone to change settings remotely, eliminating the need to re-gain physical access to the device. Protegga has not yet tested the functionality of the software, nor the digital footprint and forensic artifacts left behind by the application. Stay tuned for further testing details.

e-Discovery Abuse: Judge refers Company and Four of Its Top Officers to U.S. Attorney for Criminal Prosecution

When a defendant was caught intentionally spoliating digital evidence on five laptops, executives tried to cover up the destruction of evidence, and lied on the stand.

Philips Electronics N.A. Corp. v. BC Technical, 2011 WL 677462 at *2 (D.Utah, Feb. 16, 2011).

http://tinyurl.com/3gx3uuw

This led to severe sanctions. Judgment was entered against the defendant, fees were awarded, and the defendant and four of its top officers were referred to the United States Attorney for possible criminal prosecution.

The Judge wrote: “Willful  spoliation  of  evidence  deserves  the  harshest sanctions  because  it  is  antithetical  to  our  system of  justice.  The  evidence  is  sufficient  to  show  such willfulness  here.  The  court  therefore  concludes
both  attorney’s  fees  and  terminating  sanctions  are appropriate in this case.”
Further more, the Judge went on to write:
“Because  certain  individuals  lied  under  oath, Judge Alba recommends that his matter be referred to the United States Attorney’s Office for investigation.”
“The  Clerk  of  the  Court  is directed to send a copy of this Order, along with the Report  and  Recommendation,  to  the  Acting  United
States  Attorney  for  the  District  of  Utah  for  such action as she deems is appropriate.”

VMWare application allows iPad users to run Windows – computer forensic implications

VMWare View Client for the iPad was recently released. This application allows iPad users to run Windows in a “virtual environment” on the actual iPad. The presence of the Windows Operating System on an iPad, adds another layer of complexity to forensic examinations of iPads. If a virtual machine is used on the iPad, the examiner will be required to analyze not only the native iPad iOS, but will also have to locate the Windows Virtual Machine, which will likely be located on either the employer’s server, or be hosted by a cloud based provider. It will be important to analyze  how the two operating systems interact with each other, and whether previous versions of the virtual machine are stored on backup media.

http://blogs.vmware.com/view/2011/03/view-client-for-ipad.html

As mobile computers (Laptop, MacBook), smart phones (iPhone, Android, Windows Mobile, Blackberry), Cloud Computing, Virtual Machines, and other digital devices (iPod, iPad, NetBook, Tablet, MP3) continue to permeate our daily activities, our dependency on them increases. Through the increasing speed and bandwidth of wireless internet, technology and application software have become mobile to the point of being entrenched in our each and every move. Data from these digital devices is therefore critical to any type of legal dispute and/or process.

PROTEGGA has been aiding attorneys, individuals, and corporations involved in Civil Litigation, Family Law, Corporate Bankruptcy, Employment Law, Mergers & Acquisitions, and more since 2003. PROTEGGA proudly serves Texas and the United States from our North Texas office in Plano (a suburb of Dallas). In addition to the courts listed below, PROTEGGA has served as Computer Experts in State and Federal courts in Texas, Utah, California, New York, Florida, Oklahoma, and others.

Texas Court of Appeals reverses order compelling hard drive to be produced

In re Stern, 321 S.W.3d 828 (Tex. App. Houston 1st Dist.)

http://preview.tinyurl.com/4z9hjgy

A court must follow certain rules when authorizing a special master; a special master cannot be granted “carte blanche authorization to sort through electronic storage devices.” In this case, the Court failed to follow the proper Texas procedure in a few regards:

1) The Court of Appeals noted that granting someone access to a party’s electronic storage device is particularly intrusive and should generally be discouraged. Thus, if a court is going to allow access, there MUST be a showing that the responding party has not complied with the original discovery requests or that the original discovery response was inadequate and a further search could produce different results.

2) The information sought on hard drive must be relevant. There has to be a showing of a direction relationship between the search of the hard drive and the issue central to the case.

3) The special master should not be granted to free reign to search the hard drive at his discretion. Specific search terms should be provided as to limit the scope of the search to the relevant materials.

4) The party requesting the data must make a showing that it can actually and reasonably be retrieved.

As a result of the lower court’s failure to comply with these procedures, the Texas Court of Appeals struck down the ruling that authorized the special master and required Stern to turn over his hard drive.