Actual Digital Forensics Cases
During his years as a Special Agent with the Florida Department of Law Enforcement, Mr. Rehman performed countless computer forensic examinations, resulting in successful criminal prosecutions. This included the discovery of evidence that the perpetrator believed he had destroyed and evidence that was secured by encryption. In one case, his examination cleared the defendant.
Since retiring from FDLE in 1998, Mr. Rehman has conducted numerous examinations in civil litigation and employment matters. Below are some of our previous forensics cases.
The Board of Directors of a corporation suspected that the president was concealing important terms of an agreement with another corporation. The president resigned after our analysis found evidence confirming the Board's belief.
The director of information technology at a corporation was suspected of intercepting the email of the CEO and several other key employees. Our examination found proof of his activities, resulting in his resignation.
one case, an employee quit her job unexpectedly. Her employer was suspicious
that she was over billing clients and pocketing the profits. An analysis of
their Macintosh billing system revealed that, in an attempt to cover her tracks,
the employee had deleted hundreds of client records. Mr. Rehman was able to
recover all of the deleted records.
leave trails of their user's activity. Mr. Rehman analyzed a computer for a
company and discovered that an employee had been using it to do personal
research using very expensive databases.
the examination of a computer used by a fired employee, Mr. Rehman found a
detailed business plan that they had written. The plan was for a business to
compete against their employer and included information about other employees
that would quit to form this new company.
key employee of a large corporation left to start a competing business. Before
leaving, he formatted the hard drive of his company laptop in an attempt to
destroy evidence of violating a confidentiality agreement. His emails, letters,
memorandums, and business plans were all recovered from the laptop.
Rehman was asked by a State Attorney's Office in Florida to review evidence in a
child pornography prosecution. Mr. Rehman conducted a thorough forensic
examination of the defendant's computer, a very old (in computer terms) IBM
model PS1. A dozen child pornography files were found on the hard drive. Mr.
Rehman's expertise, however, lead him to the inescapable conclusion that the
defendant was being framed; the charges against the defendant were
Rehman conducted an examination of a computer for child pornography. The
defendant admitted to having downloaded "a few" images many months
earlier, but claimed he had destroyed them. Mr. Rehman's examination revealed a
large cache of encrypted files; he was successful in breaking the password and
recovered dozens of child pornographic images the defendant was collecting and
maintaining. The defendant pled guilty.
Another computer belonged to a defendant who claimed he had never downloaded any child pornography. The defendant admitted to having deleted numerous files prior to a search warrant, but denied they were child pornography. In examining all of the materials seized, Mr. Rehman found numerous back-up tapes. Numerous child pornographic images were found on the back-up tapes; the defendant pled guilty.