The Backwards Clock

In a case concerning misappropriation of funds, the plaintiff discovered during the defendant's deposition that he had a laptop computer they had not been told about. The defendant was informed that they wanted to submit the laptop to forensic investigation. He was further ordered not to make any changes to the computer. The deposition was on a Monday afternoon.

Defendant said the laptop was in a nearby city and that he wouldn't be able to get it until Tuesday.

On Tuesday, the defendant said he had made a mistake and the laptop was in a different city, farther away. He then said he would produce the laptop on Wednesday in the city where the expert lived. On Friday, he finally produced the laptop in another state, in the city containing the home office of the plaintiff.

As we recommend in cases involving Electronically Stored Information, ESI, we created an image of the laptop drive and subjected it to forensic examination.

We searched for certain documents we expected to be present, but they were not there. In examining the drive, we found that its date was wrong by one day, saying the last time it had been booted up was the day after we created the image.

Extensive examination revealed that the defendant had reset his computer's clock to a date three months earlier; that after about 50 minutes he returned the computer's clock to the proper time. For some reason, perhaps he forgot something, he again moved his clock back again by three months. However, when he reset the date - presumably to the proper date - he made a one day error and moved it forward by an extra day.

Additional investigation could have revealed what the defendant was doing during the time when he had set the computer clock back, but the information on spoliating the evidence was sufficient. The case settled.

To see the resume of the expert associated with this case study, see the link below.