When Brad called , he was pretty distraught. The conversation with him was peppered with one phrase. He kept saying he just wanted the truth. The truth he was seeking was about Lynn, his wife.
Lynn was a freelance graphic artist. She worked from home and spent hours in front of the computer. She had turned one of the bedrooms into a home office and after a year or two made a conscious decision to close the door to the office at 5 p.m. to indicate she was done working for the day. Lately, she’d started returning after dinner to the office and pushed the door so it was only slightly ajar. Brad was concerned that she was working too much and he missed her company.
It was when he unexpectedly took her a cup of tea one evening that he noticed she was doing more typing than artwork. But it was the way she closed things down when he walked in that caught his interest.
He admits he started spying on her because something just wasn’t right. It continued until he was convinced she was cheating. He didn’t know the extent, whether it was just instant messages (IMs) or if they were meeting during the day while he was at work.
Whatever it was, he wanted the truth. He wasn’t interested in following her or setting up any cheating spouse surveillance. No, he was thinking computer forensics discovery would tell him what he wanted to know and would be the quickest, most efficient way to get the truth.
He brought us her computer hard drive, which we quickly imaged so he could put it back before she returned and we went about the forensics process to pull the computer forensic evidence that was on the machine. It didn’t take long and the analysis of the data we were able to extract including the IMs was pretty definitive.
Some people think when you delete IMs, they are gone. They aren’t – and a computer forensics discovery process will reveal them. Not just that a conversation was occurring, but the actual content – the actual words used in the conversation.
It’s a cautionary tale, this one. You always hear the saying, gone, but not forgotten. Well, in this case, she thought the IMs were gone. Brad proved not only that they were not forgotten, but exact copies were retrievable. Brad got the truth he needed so he could make the proper decisions.
-Brenda McGinley, CEO, All in Investigations, All in Investigations
