Victor Stanley v Creative Pipe Inc Exhibits ESI

8/12/2019 Victor Stanley v Creative Pipe Inc Exhibits ESI

1/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 1 of 22Guidance~ S O F T W R E The World Leader in Digital InvestigationsTM

July 22, 2009Randell C. OggThe Law Offices of Randell C. Ogg1150 Connecticut Ave., 9th FloorWashington, DC 20036Victr:Stanley, Inc. v. Creative Pipe, Inc., et. al.pnited States District Court - District of MarylandCa e Number: MJG-06-2662 (PWG)RE: Summary of Preliminary FindingsDear Mr. Ogg:

PLAINTIFF S EXHIBIT NO. Y-- -CASE NO .: MYG-C6t ;2G, 2-J..IDENTIFICATION: 9..- f L 1ADMITTED: _ __ __:J. __ _ ~ c ~ - - -

In accordance with the Court's request of Ju ly 21, 2009, I am writing to outline my preliminary findingsrelating to the SimpleDrive External Hard Drive (EHD), the forensic image of Mark Pappas laptop andthe restored email data from the provided backup tapes of the Old Server .All of the work I have undertaken regarding the matters outlined in and authorized by the Court duringthe mediation session of June 16 2009 has been done in full consultation with Genevieve Turner ESIConsultant for the defendant. Ms. Turner and I have communicated on a regular basis where we havediscussed, in detail, all of the facts and preliminary findings below.I am also attaching my prior correspondence with Mr. Rothschild regarding these matters and mytransmittal of information and data to him.It is my opinion that the following facts are true based on my examination of the forensic image ofMark Pappas's laptop, acquired by Ms. Turner on February 23, 2007, and the restored email data fromthe provided backup t ape sets:SimpleDrive EHD1. The laptop's operating system recorded the SimpleDrive EHD was connected for the first t ime on

July 10, 2006.2. The Simple Drive EHD has a feature for a one-click process that makes it easy for the user to use

the EHD as a backup device for a personal computer. The software which enables this feature wasinstalled on Mark Pappas' laptop on July 10, 2006, within minutes of the device being firstconnected.

Page I of6215North Marengo Avenue, Suite 250, Pasadena, California 91101 I el.626 229 9191 I ax. 626 229 9199 I www.guidancesoftware.com


2/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 2 of 22

Jiu id nce-) The World Leader in Digital Investigations T~ S O F T W R E3. On July 10 2006, through the use of this backup software, 63,071 files were downloaded fromMark Pappas' laptop to the SimpleDrive EHD.4. The laptop's operating system recorded the SimpleDrive EHD was last connected on November 7,

2006. According to the report of Ms. Turner dated March 5, 2009 Mr. Pappas asserted that thishard drive failed and was returned back to the merchant; and therefore, he no longer has it in hispossession. The SimpleDrive EHD could not have been returned to the merchant by Mr. Pappasprior to November 7 2006.

5. On November 20 2006 the backup software associated with the S i m p l e r i v ~ ~ H P vvas run onPappas' laptop and a few hours later it was uninstalled. Given t h a t : t h e b ~ t k u p ~ b f t w a r e is designedto work with the SimpleDrive EHD it is highly likely that the device was connected to Pappas'laptop continuously from November 7 to November 20 as there were no new connectionsrecorded by the operating system during that period.

6. I found no evidence of any failure of the EHD. Indeed, the backup software tied to th is device wasrun multiple times by the user account associated to Mark Pappas during the period it was firstinstalled on July 10 2006, and when it was uninstalled on November 20 2006.

Pappas' Laptop - General Information1. I understand that Ms. Turner made arrangements to come to Creative Pipe's offices to forensicallyimage Pappas' laptop for discovery purposes during the week of February 20 2007 and that

Pappas' laptop was subsequently imaged by Ms. Turner on February 23 2007.2. According to Mark Pappas's Affidavit of January 29 2007 Mr. Pappas' laptop a Compaq NC 6000

was his normal work computer at Creative Pipe. Further, he stated .access to the laptop waspassword protected.

Pappas' Laptop - File System Activity

1. On July 6, 2009, a DVD containing the first set of deliverables from Mark Pappas's Laptop, per theESI search and collection protocols agreed to during the mediation meeting of both parties withJudge Grimm on June 16, 2009 was delivered to Mr. Rothschild, attorney for the defendant, and afile copy of same to Ms. Turner. The DVD in part, contained the following:

a. A listing of all file objects and their respective file system metadata. This listing wasgenerated using Encase v6.13 and outputted to a standard text based CSV formatted filewhich can be viewed using any modern spreadsheet application such as Microsoft Excel.

Page2 of6215 North Marengo Avenue, Suite 250, Pasadena, California 91101 I el.626 229 9191 I ax. 626 229 9199 I www.guidancesoftware.com


3/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 3 of 22uid nce ~ S O T W R The World Leader in Digital lnvestigationsrn

b. A listing of all deleted file objects and their respective file system metadata. This listing wasgenerated and outputted the same as the listing in po int 1 above.c. A listing of file objects that were deleted using the Recycle Bin function. This listing was

generated and outputted the same as the listing in point 1 above.2. On July 10 2009 per the email instructions of Mr. Rothschild I provided these three 3) file listings

to you. A review of the listed files and their associated file system meta data from October 11 2006through February 23 2007 showed the following number of file deletions1 for the listed file typesduring the time periods shown :

Doc 1 2 245 918 3 164Dwg 1 161 194 365Jpg 332 11 3 404 1 814 5 561Mpg 4 4Pdf 4 688 255 947Rtf 7 7Tif 4 9 12 85Xis 2 035 216 2 251Zip 2 2 669 907 1 580

3 . .During an approximate 40 minute period on the afternoon of Wednesday January 31 2007 therewere a total of 9 234 deletions comprising almost the entirety of the above listed 9 282 file typesdeleted between December 23 2006 and February 1, 2007.

4. Starting in the afternoon of Friday February 16 2007 and into the early morning of SaturdayFebruary 17 2007 there were a total of 3 969 deletions comprising a vast majority of the abovelisted 4 316 file types deleted in the February 2007 time period.

5. The recycle bin records for 210 deleted files processed by the user account associated with Mr.Pappas during th e early morning of February 17 2007 was recovered from the unallocated spaceofthe laptop. A review of the recovered Recycle Bin records show that the lowest Record ID has a

1 These figures exclude automatic or system generated file deletions and any file activity recorded within the temporaryinternet folders.

Page 3 of6215 North Marengo Avenue Suite 250, Pasadena, California 91101 I el.626 229 9191 I ax. 626 229 9199 I www.guidancesoftware.com


4/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 4 of 22uid nce Y soFTWARE The World Leader in Digital lnvestigationsrn

value of 1256. Thi s indicates that at least 1255 files had already been processed through theRecycle Bin between the time that the Recycle Bin had been last emptied and the system rebooted.

6. During the late morning of Saturday, February 17, 2007 there was a user-initiated execution of theoperating system's Disk Defragmenter utility application. This was the first and only userinitiated execution of that app lication on that laptop. The running of th disk defragmentationprogram completed successfully and, as such, l was unable to recover any of the above listeddeleted file types in any intelligible form nor was I able to recover any other information regardingthe use ofthe systems Recycle Bin functionality

. :The Back-Up Tapes1. During the mediation meeting of both parties with Judge Grimm on June 16, 2009, Defendants

agreed to provide the backup tapes for the old server for the period just preceding the swap ofservers that occurred on April 17, 2007. However, Defendants provided a mix of t n (10} tapeswhich contained two incomplete data backup sets, one for November 15, 2006 and one for January17, 2007. Iwas provided no explanation why the Defendant failed to provide the tapes for theperiod immediately before the swap of servers.

2. Despite the incompleteness of the tapes, a full set of email message stores was able to be restoredfrom the January 17, 2007 tape set. These message stores were processed in accordance with the2007 Joint Protocol and the June 2009 Protocol that was developed during the mediation session.

3. The combined message stores contained 81,403 email messages with 30,548 attachments for atotal of 111,951 items. After processing per the agreed search and collection protocols, this bodyof data was reduced to 36,361 email messages with 5,174 attachments for a total of 41,535responsive items. A summary of the responsive items per email store is as follows:

t ~ ~ t ~ ~ i i ~ f ~ ~ ~ ~ ~ i : ; r : ~ ~ ~ 1 ~ ~ ~ ~ ~ f f i ~ ~ t S . t . ~ t P l i / , ~ H t ~ ' . t ~ h ~ t ~ , \ , ; : i f @ . . ~ M 1 f l : e 2 . ; : , ~ i f \ f i l W ~ - ~ ~ t i ~ T i t : f J l ~ W l ~ R ~ 1 ~ l ~ l ~ 1 i . ~ i f . i J J ' ~ ~ iCalendar 3 3Contacts 4 1 19 24Deleted Items 2 1 114 30 43 5,139 5,329Drafts 1 1Inbox 3 8 1,815 27 457 12,286 14,616Personal Folders 12,623 12,623Sent Items 1 7,653 197 9 18 1,046 8,924Tasks 15 15

Page 4 of 6215 North Marengo Avenue Suite 250 Pasadena California 91101 I el.626 229 9191 I ax. 626 229 9199 I wwwguidancesoftware.com


5/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 5 of 22uid e~ S O F T W R E The World Leader in Digital Investigations TM

4. Of the 5,329 responsive emails stored within the Deleted Items folders across all email stores,657 were received on or after October 11, 2006.

5. In order to be perfectly clear regarding the email message stores, what was processed is whatexisted in the Old Server Exchange database as of the time of the backup occurring on January17, 2007. Due to the nature of the tape backup and restoration process, it is not possible to locateand recover any email messages, or their respective attachments, that would have been moved toa users Deleted Items folder and then purged.

Recommendations for further Examination I have previously suggested that the following additional forensic work be done in order to track thewhereabouts of the SimpleDrive EHD in an attempt t o recover any of its contents and to locate andrecover any other deleted files from the Pappas laptop:1. Guidance Software should be authorized to check the Gu idance copy of the images of all CPI

drives to ascertain if and when any external hard drive or storage device had been connected tothat particular computer and then to provide a list of all such attachments to counsel for theparties. This would expand the last sentence of paragraph 1 of the June 16 Meeting Protocol toinclude all the current images in Guidance's possession. This is requested as it may help identify theexistence of any other previously undisclosed externa l device which may contain responsive ESI.

2 That the process outlined in the first sentence of paragraph 1 of the June 16 Meeting Protocol beexpanded to include Ms. Doll's computer and Ms. Hayes' laptop. This is requested because i herewere substantial deletions from the Pappas laptop after the filing of the lawsuit it is a reasonablehypothesis that there were similar deletions from the other computers of key personnel. Thisexaminat ion also may lead to information relating to the recoverability of any data deleted fromthe Pappas laptop or that was copied to the Simple Drive EHD.

3. That the ES consultants {Ms. Turner and myself or our designees) be allowed to jointly check thepreviously identified Creative Pipe/Pappas computers' system registries for any attachment of theSimpleDrive EHD on or after November 7, 2006. If this check shows any such evidence of anattachment/use of the SimpleDrive EHD on or after that date, the consultants will be allowed toforensically image that computer at that time The consultants will then develop a protocol forfurther forensic evaluation of the uses the SimpleDrive, its possible location, or the location of anycontent of that device that may have been subsequently copied or used. No access or analysis wi l lbe undertaken on the new images until the consultants agree on the protocol. This is requested toassist in both identifying the whereabouts of the missing Simple Drive EHD and in the possiblerecovery of ts contents. If the SimpleDrive EHD was connected to a Creative Pipe or Pappascomputer anytime between the imaging of that computer in 2007 and the present then i t is

Page 5 of215 North Marengo Avenue, Suite 250, Pasadena, California 91101 I el.626 229 9191 I ax. 626 229 9199 I www.guidancesoftware .com


6/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 6 of 22 uidance~ S O F T W R E The World Leader n Digital Investigations

probable that computer contains data copied from Pappas laptop to the Simple Drive EHD on July10 2006.

4. That Guidance Software be authorized to undertake full restorative efforts on the backup tapes andthen search for responsive materials in accordance with the Joint Search Protocol and to conductother restorative efforts as outlined in your letter of July 7 2 9 to Mr. Rothschild. Mr. Rothschildpreviously rejected this request in a letter of July 9 2009.

renew my recommendations that above items be undertaken as soon as possible.Lastly, I understand thatJudge Grimm has ordered a meeting between both parties qfld theirrespective ESI consultants in which these preliminary findings and recommendations are to bediscussed. Unless otherwise ordered by the court, I must insist on this meeting, and any other futuremeetings in which Mr. Rothschild and I jointly take part, be recorded.Respectfully,

Andreas T. SpruillSr. Director of Risk ManagementGuidance Software, Inc.

ENCL: (1) Letter to James Rothschild, Esq., dated July 1, 2009, RE: Production of ESI(2) Letter to James Rothschild, Esq., dated July 7, 2009, RE: Victor Stanley v. Creative Pipe(3) Letter to Randy Ogg, Esq., dated July 9, 2009, RE: Victory Stanley v. Creative Pipe

Page 6 of 6215 North Marengo Avenue Suite 250 Pasadena California 91101 I el.626 229 9191 I ax. 626 229 9199 I www.guidancesoftware.com


7/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 7 of 22r--uidance S O F T W R E Professional Services DivisionPLAINTIFF S EXHIBIT NO CASE NO ~ C c DJ lRfoJ.IDENTIFICATI0 N _ _r. _ _ 0--------ADMITTED: v

The World Leader in Digital Investigations TM ANDREAS ANDY SPRUILLCurriculum VitaePresent EmploymentGuidance Software, Inc.

Directot of Risk Management (10/2008 - Present)Identify and take steps to minimize corporate risk before it is escalated to potential liability.Directty oversee aH Internal Investigations, Operational Audits and eDiscovery in response tolitigation.Directorof Operations (07/2006 - 09/2008)Oversee the worid-wide operations of Guidance Software s Professional Services Division.Director, Western Region (09/ 2005 - 06/2006)Oversee tne western us and Pacific Rim operations of Guidance Software s ProfessionalServices Division.SeniorForensic Examiner (01/2004 - 08/2005)Conduct forensic examinations in support of customer requests; assist and train customers inthe use of Encase software and methodology, and provide expert testimony in the field ofcomputer -forensics.

Westminster Police DepartmentPolice Officer (Reserve) (0912002 - Present)Conduct forensic examinations in support of criminal investigations and assist departmentpersonnel in the investigation of high technology crime.

California State University - Funer tonInstructor, Computer Forensics 08/2005- Pm-sentDevelop and teach the curriculum for a year long program designed to meet the needs ofindividuals entering the field of computer forensics. The Certificate in Computer Forensicsconsists of five courses totaling 94 dass room hours of lecture and hands-on experience.

EducationMaster of Business dministrationUniversity of California - irvineGraduated; 0612000Emphasis in Information Technology

Military ServiceUnited States nny

Bachelor of Science, PsychologyUniversity of MaryiandGraduated-: 0511992

Counterintelligence Special Agent (04/1986 - 0311993Conducted strategic counterintelligence operations and investigations, personnel securityinvestigations, and investigations of terrorist activity involving US rmy assets.

TrainingEncase Network Intrusion ExaminationsGuidance Software, Inc.


8/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 8 of 22Incident Response, Forensic Analysis and DiscoveryGuidance Software Inc.EnCase Advanced Computer ForensicsGuidance Soffware Inc.Investigation of Computer CrimeSEARCH, Inc.Encase Introduction to Computer ForensicsGuidance Software, Inc.

Speaking EngagementsSecurity Incident ResponseFinancial Summit 2007, Mexico City, MexicoPortable Applications U3: A Forensic LookNetSec 2007, CSI, Phoenix, ArizonaMetadata and th Federal Rules of Evidence2006 American Bar Association, SEER Annual Conference, San Diego, CaliforniaUsing Computer Forensics to Counter Gang Activity2006 Annual Intercontinental Conference on Terrorism and Asian Organized Crime Conference,Anaheim, CaliforniaIntellectual Property Theft LossHTCIA 2005 Annual Training Conference Expo Monterey, CaliforniaCyber-lntelligence: Definitions, Terms and TrendsNetSec 2005, CSI, Phoenix, Arizona

PublicationsTackling the U3 Trend with Computer ForensicsJournal o Digital Investigation, Volume 4, Issue 1, March 2007, Pages 7-12http:llwww.sciencedirect.comTestimonyDowney Savings Loan F.A. v. Chevy Chase Bank, F.S.B.Superior Court of he State of California, County o OrangeCase Number C C 8 8 5Victor Stanley, Inc. v. Creative Pipe Inc.United States District Court, District o MarylandCase Number MJG-


9/22

Case8:06

-cv-02662-MJG

Document

336-1

Filed12/03/09

Page

9of22

~

New e r v e r l l Da: o.

\/ l; . I

1 _ } I;,..1CJA V 1 .: , ' ' : ; ~ :....--;i)JP1 .

I dii1~ PSTI Files(Emails) _ /-----

Mark PappasNotebook

.Network Share

Folders\.

- - - - - ...../ . \ ': r}J : ~1. .. teaNetwork I ~D1ive I ~Folder} Im=1.1.

Outlook

I ~I ~IQ;IZJ..._ - - - - _,,,,,

------------

Exchange ..PServer CMailbox Store IA

-----------

--- - - - -1 > .6 I : t : : In ._,,.,.,.ml -1'- ~ '


10/22


LAW OFFICES OF RANDELL C OGG ESQUIREADMITTED IN:DISTRICT OF COLUMBIAMARYLANDVIRGINIAMEMBER:AMERICAN BOARD OF TRIAL ADVOCATES

August 25, 2009VIA ELECTRONIC CASE FILINGThe Honorable Paul W. GrimmUnited States District Court for the District of Maryland101 W. Lombard StreetRoom 8BBaltimore, M 21201

NJNTH FLOOR CONNECTICUT BUILDING1150 CONNECTICUTAVENUE NWWASHJNGTON D.C. 20036-4192TELEPHONE: 202-862-4323

FACSIMILE [email protected]

PLAINTIFF'S EXHiPIT N? CASE NO.: 8S0--Gl * - ( p l ~ -IDENTIFICATION: :::-J -O


11/22


2. As to Recommendation 3, all provisions were agreed to expect for the sentencethat: "No access or analysis will be undertaken on the new image until the consultantsagree on the protocol." t was Defendants and their consultant's position that_theconsultants and the parties' counsel would have to agree on the protocol before anyaccess or analysis would be undertaken .3. As to Recommendation 4, the consultants agreed that any fi les of a type

associated with email (e.g. pst, eml, msg) be restored from both of the tape backup setsand processed per the June 16 Meeting Protocol. o date, only the Microsoft Exchangeemail stores from the January 17, 2007 tape backup set have been restored and processed.They disagreed as to whether the restoration, and subsequent processing, includes allrestorable files contained in both of the tape backup sets. It was Defendants' counsel'sposition that any restoration efforts be limited strictly to emails. Defendants and Mr.Maschke would reconsider restoring files on the back-up tapes but only if those files thatmatched up based on available file metadata to specific files that were downloaded.4. The consultants agreed to continue attempts at getting a sound forensic image ofthe "Old Server." f a sound forensic image can be attained, the consultants agreed that

any files of a type associated with email (e.g. pst, em , msg) and the Exchange Serverdatabases be collected, and if possible, processed per the June 16 Meeting Protocol.They disagreed as to whether all files contained on the "Old Server" be processed per thisprotocol. Again, it was Defendants' counsel and its consultant's position that any effortsbe limited strictly to emails.Subsequent to the July 22, 2009 Report, Mr. Spruill recommended that theconsultants be allowed to collect and analyze the transmittal logs for the Exchange Serverand the Operating System Event Logs for the purpose of assisting the consultants inlocating data helpful to possible recovery of deleted emails and other files, conducting ananalysis to determine the circumstances surrounding the deletions of the emails and other

deletions identified in the Spruill Report, assisting in the identification of when thedeletions occurred, and in determining how and why certain data available on the OldServer was not produced in October 2007 in accordance with the Joint Search Protocol.The system logs also could assist in determining why the old server crashed. Defendants'counsel and consultant objected to the use or analysis by Guidance Software or VSI ofthe transmittal logs or system event logs of the "Old Server" on the grounds that a therehad been no discovery request for those system documents prior to the close of discovery,and b) they were irrelevant to the issue of deleted emails and deleted files.This letter has been reviewed and approved by counsel for the Defendants.

This recommendation was made subsequent to the July 22, 2009 Report and previouslycommunicated to Defendants on August 17, 2009.

ll\DC-028214 000001 2953?00 vi 2


12/22


Very trul Y yours\ . /M/ 1 ,\ . . ~

\ / I\ ~ /JjI . gg [Cc: Counsel of Record (via ECF \_

ll\DC - 028214 000001 2953700 J 3


13/22

Case 8:06-cv-02662-MJG Document 336-1 Filed 12/03/09 Page 13 of 22LAINTIFF S EXHI IT NO l/ f .CASE NO.: l--\Y(- -- _-;i_l,, c;,J._IDENTIFICATION: L c,qADMITTED: ;;2 f O c

Photos depict the residence owned by Mark Pappas located at 76-307 ViaMontelena Indian Well california.


14/22


Row Labels Items11 20 2006 560211 21 2006 311 23 2006 26811 28 2006 112 5 2006 712 6 2006 112 7 2006 412 8 2006 212 112006 412 12 2006 412 13 2006 312 14 2006 512 15 2006 312 16 2006 412 18 2006 412 19 2006 4 . LAINTIFF S EXHIBIT NO. 5012 20 2006 2 CASENO.: ~ . : r c = C t c , ~ [ c f c ; .12 21 2006 4 IDENTIFICATION: J ~ l C 912 22 2006 2 ADMITTED: l J ~ l cc112 23 2006 212 24 2006 57112 26 2006 712 27 2006 412 28 2006 312 29 2006 112 30 2006 11 2 2007 31 3 2007 11 4 2007 31 5 2007 21 6 2007 11 8 2007 41 9 2007 31 10 2007 91 11 2007 81 15 2007 31 16 2007 71 17 2007 1

rand Total 6561


15/22


16/22


UNITED : 3 T l \ T DISTRICT COURTTH E IIS'l'RIC'I' OF MARYU \.N

VICTOR STANLEY, INC . Pla in t i f f

vs .

CREATIVE PIPE INC . e t a l .De fendants .

VIDEOTAPEDDEPOSITION OF :OATS AND TIME :

LOCATION :

REPORTER :

Case No . : MJG - 06 - 2662

Evan DeRoue nJune 29 200 710 : 01 a .m.340 South Far re l l Dri veSui te A-20?Palm Springs Cal i fo rn iaMireJ .la 0 . Leyva CSR RPRCer t i f i ca t e No . 11614

PLAINTIFF S EXHlBIT NO. -CASE NO. ~ . \ . G--t_ p ::JLelod..IDENTIFICATION: ___ __ ~ _ - = 0ADMITTED: /r J. I 0 1


17/22


18/22


11 : 38 : 31 1

34

11 : 38 : 40 567B9

11 : 38 : 5 4 1011121314

11 : 39 : 03 1516171819

11 : 39 : 16 2021222324

11 : 39 : 30 25

Q. Okay . Who t o l d you t h a t?A. want to say Mark and/o r js a t t o rneys .Q. Okay . And when were you t o l d t h a t ?A. We had a confe rence ca ll seve r a l months ago

I don t remember the ex ac t d a t e .Q. Okay . Was t in 2007?A. Ye s .Q. Okay . Was t in February o f 20 07?A. That s qui t e poss ib l e .Q. Okay . And do you remember what was t o l d to

you a t t ha t t ime?A. Bas ica l ly I was asked ques t ions about the

sys tem .Q . Okay . And what kind o f q u es t i o n s?A. Ju s t th e i r bas i c usage more o r l e s s the

same th ings you guys wanted to know about th e i rco n f i g u ra t i o n and whatnot .

Q. Okay . And what were you t o l d aboutpr e se r va t ion o f data a t t ha t t ime?

A Well , t h a t we need not to d e l e t e anyth ing .Q Okay Did you t ake any spec ia l ac t i o n s to

make su r e t h a t happened?A. Ye s . I removed th e the f u n c t io n t h a t

al lowed the logs to be purged once they re backed up .Q. Okay . And i s t h a t change st ll in p lace?

88


19/22


11 : 39 : 33 1>

34

11:39 : 41 56789

11 : 39 : 58 1011121314

11 :4 0 : 06 1516171819

11 :4 0 : 19 202122232 4

11 : 40:32 25

A. Yes .Q . Is th ere anyth ing e l se tha t you v 0 done as

r e su l t of t ha t conversa t ion?A . Oth e r than mak e s u r e th e ba ckups a re done , no .Q. I s th e re - - hav e there been any othe r

conve r sa t i ons r ega rding th i s litiga t ion with anyone?A. No.Q. Okay . I th i nk th a t a t t h i s poin t I have no

fu r ther ques t ions .A. Per f ec t .MR MOHR : I a c t u a l l y have a f e w.THE VIDEOGRAPHER : Put you r microphone on , p l ease ,

s i r .MR . MOHR: Oh , I m sor ry .

EXAMINATIONBY MR MOHR :

Q Okay . Wh e n you sa id t ha t th e data on - - t h a tt he s t u f f in th e i nd iv idua l computers i s mappe d to th ese r ve r , i t he ind iv idu a l hard dr ives , i those wereimaged wou ld you have - - wou l d t ha t be the samema t e r i a l t ha t was on t he server or in the se r ve r f i l e s ,o r would i t be d i f f e r en t?

A. I t d be d i f e r en t .Q. All r i ght . I f you - - with r es p e c t to th e - -

89


20/22


11 : 40 : 36 1 wi th resp e c t t o t he se rve r logs and p r e s e r v a t i one f f o r t s , as ide f ro m th a t the r lelet ion of any

3 p a r t i c u l a r p i ece o f informat ion would b a s i c a l l y have to4 be don e manual ly r i g h t ? I mea n somebody wou ld

11 : 40 : 50 5 a c tua l ly have to go in and - -6 A . Ye s .7 Q. - - and de le te a p a r t i .c u l a r p iece o f8 in f ormat ion?9 A. Yes.

11:40 :55 10 Q. Al l r i g h t .11 A. And th e on ly fo lde r s they would be ab le to12 d e l e t e t h a t from would be t he i r own.13 Q. Okay . All r igh t . To your knowledge , have any14 documents been de l e t e d or des t royed?

11 : 41 : 10 15 A. Not to my knowledge .16 Q. Okay I don t have any more ques t ions .1718 FURTHER EXAMINATION19 BY WOLINSKY :

11 :4 1 :3 2 20 Q. J u s t to make sure I m c l e a r I have one more2 ques t ion I t h ink . That ques t ion i s : I f an i n d i v idua l22 use r went i n t o t he i r fo lde rs s to re d on t he se rve r and23 de l e t e d f i l es one month ago , Crea t ive Pipe would no24 longe r have a backup of those l es and - - from t he i r

11 : 41 : 5 4 2r J s y s t em; c or re c t ?

90


21/22


11 : 41 : 58 1 A . Yeah . No , if th e y d e l e t ed t h e f i l e s th e y2 wnu d no t b e therP . Th e main backup ge t s oven -1.r i t : ten3 o n every Lwo- week p er io d .4 Q. And was th e r e any s t ep s t h a t we r e put in p lace

11 : 42 : 10 ,-_) to preven t anyone from d e l e t i ng f i l e s from t h e f i l e6 s e rv e r ?7 A . No.8 Q. Could s t ep s have been t aken to p r ev en t tha t '?9 A. A p o l i cy could be s e t , but I was not

11 :4 2 : 23 10 r eq u es t ed .Q. What kind o f p o l i cy would t h a t be ?

12 A . A group p o l i cy .13 Q. And what would - - t h e p o l i cy would be , no14 dele t ions '?

11 :4 2 : 29 15 A . Yeah , it would be , doesn t have t h e a b i l i t y to16 wr i t e or de le t e fil es .17 MR . WOLINSKY : Okay . I have no t h i n g f u r t h e r .18 THE VIDEOGRAPH ER: Are we i l l l done , qentlemen ?1 9 MR WOLINSKY : I be li eve so . Thank you very much

11 : 42 : 46 20 i o r your t ime , Mr . DeRouen . I a p p r e c i a t e it .21 THE WITNESS : Thank you .22 MR . OGG : Somebody j u s t may want to l e t him know23 about hi s waiv e r - - hi s r ead ing r i q h t s .24 MR . MOHR : Yeah, you have - - y o u ' r e going to g e t

l l : J2 : 54 25 under t h e Federa l Rules , you have a r i g h t to r ev iew

91


22/22


From: Mark Pappas [[email protected]]Sent : Monday , Oc t ober 26, 2009 2:57 PMTo: James A. Roth sc h i l dSubjec t : FW: Dele ted f i l e sHere i s t h e e-mai l from Evan . While he f a i l s to mention the exac t da te , t wast h e Jan. 31 de le t ions to which he i s r e f e r r ing based on t h e conversa t ion we hadand on the f ac t t ha t these d e f in i t e ly were not done y me.Also, as d is cussed t h e broken l ap top o f Jeane t te ' s wi l l be sen t o f f t o Guidance.I d id not know Evan agreed to do t h i s with Andy.Thanks,Mark PappasCrea t ive Pipe , Inc.www.creat ivepipe.com- - - - - Orig ina l Message- - - - -From: ev.rouend@gmail .com [mailto:[email protected]) On Behalf Of evansen t : Fr iday, Oct ober 23, 2009 10:43 AMTo: mark@creat ivepipe.comSUbject: Dele ted f i l e sMark,Per our bra ins torming conve r sa t ion yes te rday, I th ink we have f igured out j u s thow and where these de le ted f i l e s are . Bas ica l ly they are st ll on t he server ,t h e r e a r e 3 copies o f your home fo lder in t he re .l i s c a l l e d Mark, t ha t i s your working home d i r ec to ry . The o ther 2 are cop iesc r e a t e d a t d i f f e r e n t po in t s fo r p rese rva t ion and maintenance reasons . Thosed i r ec t o r i e s are c a l l e d Mark copy and New Folder . Some t ime ago you were havingt r oub le with the synchr on iza t ion o f your home fo lde r . Your f r u s t r a t i o n with twas g e t t i n g high and you were l eaving to go on a t r i p . You had c a l l e d me up tohave me copy your home d i r e c t o r y over to your l ap top l o c a l l y . I came in ands t a r t e d the copy o f mark copy i n to your laptop. There was a reason I had tos t o p t he copy but I don ' t remember now why, I t h i n k maybe t was t ak ing a longt ime to copy a l l t h e f i l e s . So the re was only a p a r t i a l copy of the d i r ec to ry onyour l ap top . I t h i n k we di scussed t and dec ided t ha t t would be good enoughfo r your t r i p and we would s o r t out t he i s sues with the sync when you got back.When you got back you c a l l e d me in , and I worked on the sync. Once t ha t wasf ixed and t e s ted L de le t ed the copy o f your da ta (mark copy) I had made ontoyour l ap top . Technica l ly the d a t a t h a t was de le ted was a copy o f a copy andshouldn ' t be a b ig dea l . As _a mat te r of f ac t t st ll e x i s t s on your se rver int he s t a t e t was on the day I made the t r ans fe r . I see t h a t no preserva t ionv io l a t i o n has been made, my only r eg re t i s t ha t I d i d n ' t remember t h i s sooner .

Evan DeRouenRouend Computing760.578.8101www.rouend.com P L I N T I ~ S EXHIBIT NO 3

CASE NO. ~ \ T _ ; . . - ; c , Q /_ L.a_?IDENTIFICATION: J / -0ADMITTED: d O l

Victor Stanley v Creative Pipe Inc Exhibits ESI

Documents

Transcript of Victor Stanley v Creative Pipe Inc Exhibits ESI