RMRI, LLC.'s Blog

Private Investigations Blog

Posts Tagged ‘Digital Forensics

Notice To Preserve Evidence: EFFECTIVE Evidence Gathering

with one comment

First, I should preface this post. This blog post is in the legal category of my blog, but I am NOT an attorney. Always follow the discretion of your attorney over what I say and/or write. Your attorney will understand things about your case that nobody else will, like the nuances of your case, the general attitudes that key people in your case have, and such. So, always listen to your attorney in your case, over anyone else.

Now, on to the topic of this blog post. This blog post is about the Notice To Preserve Evidence Letter, sometimes referred to as the Litigation Hold Letter. This has to be one of the most effective tools for gathering evidence that I have ever used, but yet one of the most overlooked tools that I know of. The Notice To Preserve Evidence Letter is very powerful, if worded correctly and explained correctly to the person it is being served to.

I have served these Notice To Preserve Evidence Letters for over 10 years, and although attorney’s seem to overlook using them, or at least seem to rarely use them, we have gotten evidence that we would not have gotten without using them. In one case we got video evidence that actually exonerated a client on drug trafficking charges, and in another case we got video evidence that assisted a client in securing a settlement from city government. 

Below is a photo of an old Notice To Preserve Evidence Letter that RMRI, LLC. used to get video evidence that resulted in our client obtaining a settlement from the city of Columbia, MO.

The benefit to the Notice To Preserve Evidence Letter is that it puts a burden on the person that it is being served to, that often times influences that person to turn over the requested evidence when they are being served rather than have to try to keep up with it and risk losing it. In the case mentioned in the previous paragraph, where our client was exonerated from drug trafficking charges, RMRI, LLC. served a Notice To Preserve Evidence on a local hotel for video footage in the time frame that the arrest and search of our client occurred, and we found evidence that the items that were found in the search did not belong to our client, nor did he have any knowledge that they were there. The evidence was compelling enough that the prosecution dropped all charges against our client. The hotel did not want to have to pull the video, store it, and be responsible for it, so the management decided to allow us to pull the video and process it the same day we served the the hotel with the Notice To Preserve Evidence Letter. We actually got key video evidence in this case before the local law enforcement agency that investigated this case did. In the other aforementioned case where our client got a settlement from the city, we also got that video evidence before local law enforcement did, the Notice To Preserve Evidence Letter in that case is pictured above.

Typically, Notice To Preserve Evidence or Litigation Hold Letters are used in civil cases, however I know of no case law, court rule, or procedure which bars them from being used in a criminal case. 

The Notice To Preserve Evidence Letter should be crafted by the Private Investigator in these criminal cases, since the Private Investigator should know what specific evidence to target, approved by the attorney, and then served by the Private Investigator. Serving the Notice To Preserve Evidence Letter is no different than process service, as a matter of fact it is process service. After the Notice To Preserve Evidence is served, the signatures are taken and the time and date are filled out, a copy of it should be put in the court docket. This allows the court to see that the party that was in possession of said evidence was put on notice to preserve that evidence in a legal matter. 

The Notice To Preserve Evidence Letter has been one of the most powerful tools that I have ever used in gathering evidence in criminal and civil cases.

RMRI, LLC. hopes to see this tool more widely used by attorney’s and private investigators to gather key evidence that may exonerate their clients in criminal cases or win judgments in civil cases.

Rick Gurley of RMRI, LLC.

Working A Good Case With Good People

leave a comment »

Back in the last part of 2011 RMRI, Inc. was called upon to review a case in Camdenton, MO. The case involved a young man who had three illegal files on his computer. The state of Missouri Family Services Division has what is known as a “Stat Team”; this is the team of Investigators that conduct technical investigations for the Division of Family Services. The “Stat Team” conducts Computer Forensics Examinations in cases where they might have a complaint of sexual abuse in the family home. If the “Stat Team” finds illegal content on the computer that the Investigator is examining the Investigator that did the examination can refer this case for prosecution.

In the case that RMRI, Inc. was contacted about the Missouri “Stat Team” found three images on the defendant’s computer of an illegal nature. Often times RMRI, Inc. will be called in by the defense attorney to consult on these types of cases. Because these specific types of cases are so technical due to the very nature of these cases often the Defense Attorney wants to call on an expert to explain exactly what occurred on the defendant’s computer that resulted in these charges, to interpret the evidence since it will usually consist of a good deal of technical jargon, and to see if the Investigator made any statements that might indicate that he or she did not correctly interpret their evidence. RMRI, Inc. has some of the best expert witnesses in the state of Missouri for cases involving almost all manners of digital evidence. RMRI, Inc. has a “Technical Team” of two experts that have a combined fifty years of experience in working with everything from software development and programming, source code analysis, virus and malware defense and protection, computer repair, file recovery, software development, computer security consulting, and forensic acquisition techniques.

When RMRI, Inc. is first called in to consult on a case of this nature the first thing that we want to do is see all of the discovery on these cases. We want to see the report from the Investigator that did the forensic analysis of the computer in question, we want to see any deposition material where the Investigators were deposed by the defense attorney, we want to see any interviews conducted with the defendant, and anything else that the prosecution has provided that will give us an accurate picture of what happened to cause the defendant to be charged. RMRI, Inc. also wants to be present for any testimony that the Investigator that worked this type of case gives.

In the present case that we are discussing here, the testimony of the Investigator that conducted the computer forensics examination on the defendant’s computer gave us great pause as to whether this Investigator correctly interpreted the evidence that he found on the defendant’s computer. In this case the Investigator believed that the defendant downloaded three illegal files to their computer for viewing. The reality of the case is that the defendant never even knew that these files resided on their computer. These files were simply thumbnails that were residing in the temporary file section of the defendant’s computer and were put their as a result of the defendant looking at a website, but NOT even knowing that this website would place these thumbnail images on their computer as a result of viewing this website. Through careful and methodical research RMRI, Inc. was able to not only come to understand what had occurred on the defendant’s computer but was also prepared to prove what happened on the defendant’s computer.

The main figure in this case that was actually able to get this case dismissed at deposition without it ever seeing a trial was the attorney. The attorney is Deirdre O’Donnell of Phillips, McElyea, Carpenter, & Welch, P.C. who was one of the sharpest and most intelligent attorneys that I have ever worked with. Deirdre grasped the issues that we found very quickly, she understood our explanation of what occurred  in this case, and she clearly understood what questions needed to be asked of the Investigator for the state of Missouri. Below are the contact details for Deirdre O’Donnell:

Deirdre O’Donnell

Firm: Phillips, McElyea, Carpenter, & Welch, P.C.

Website: http://www.pmcwlaw.com

Phone Number: (573) 346-7231

Address: 85 Court Circle N.W., Camdenton, MO. 65020

After RMRI, Inc. heard the State’s Investigator testify, analyzed the discovery evidence, and then worked with Deirdre a little on going over what had occurred on the defendant’s computer, Deirdre decided to depose the State’s Investigator. RMRI, Inc. worked with Deirdre on some of the more technical questions that she would ask the State’s Investigator during deposition, and Deirdre already had a comprehensive understanding of the issues that we wanted to find out more about in deposition, but RMRI, Inc.’s Technical Expert wanted to make sure that Deirdre was armed with all of the questions necessary to give us a complete understanding of what lead the State’s Investigator to apply for charges against the defendant in this case.

Deirdre O’Donnell spent countless hours preparing for this deposition, and she went into the deposition and started asking key questions of the State’s Investigator as to what he believed happened on the defendant’s computer, and why he believed as he did. The State’s Investigator had enough integrity and honor to admit shortly into the deposition that he did not have a complete understanding of how to conduct a forensic examination at the time of his testimony because he had only had the basic computer forensics course at that time; since his testimony he had taken an intermediary computer forensics course and has come to understand that some of what he testified to may not have been completely accurate. At this point in time the Prosecuting Attorney “nollied” (dismissed)  the case against the defendant. The State’s Investigator and the Prosecuting Attorney showed a tremendous amount of integrity and honor once they came to an accurate understanding of what had occurred in this case.

Deirdre O’Donnell fought intelligently and passionately for her client. Deirdre worked this case in the most effective way possible and achieved the best possible outcome on this case. It takes a lot of work to convince a Prosecutor that he or she should drop charges and not proceed to trial. The Defense Attorney has to be able to clearly convince the Prosecutor that a crime was not committed; and Deirdre did that perfectly! God forbid, but if I ever have legal problem in the Camdenton, MO. area the ONLY attorney I would hire in that part of Missouri would be Deirdre O’Donnell!

%d bloggers like this: