Actual Cases

Providing Digital Forensic and Expert Witness Services since 1998

ACTUAL DIGITAL FORENSICS CASES

During his years as a Special Agent with the Florida Department of Law Enforcement, Mr. Rehman performed countless computer forensic examinations, resulting in successful criminal prosecutions. This included the discovery of evidence that the perpetrator believed he had destroyed and evidence that was secured by encryption. In one case, his examination cleared the defendant.

Since retiring from FDLE in 1998, Mr. Rehman has conducted countless examinations in civil litigation, criminal prosecutions, and employment matters. Below are some of our previous forensics cases.

The Board of Directors of a corporation suspected that the president was concealing important terms of an agreement with another corporation. The president resigned after our analysis found evidence confirming the Board's belief.

The director of information technology at a corporation was suspected of intercepting the email of the CEO and several other key employees. Our examination found proof of his activities, resulting in his resignation.


In one case, an employee quit her job unexpectedly. Her employer was suspicious that she was over billing clients and pocketing the profits. An analysis of their Macintosh billing system revealed that, in an attempt to cover her tracks, the employee had deleted hundreds of client records. Mr. Rehman was able to recover all of the deleted records.


Computers leave trails of their user's activity. Mr. Rehman analyzed a computer for a company and discovered that an employee had been using it to do personal research using very expensive databases.


In the examination of a computer used by a fired employee, Mr. Rehman found a detailed business plan that they had written. The plan was for a business to compete against their employer and included information about other employees that would quit to form this new company.


A key employee of a large corporation left to start a competing business. Before leaving, he formatted the hard drive of his company laptop in an attempt to destroy evidence of violating a confidentiality agreement. His emails, letters, memorandums, and business plans were all recovered from the laptop.


Mr. Rehman was asked by a State Attorney's Office in Florida to review evidence in a child pornography prosecution. Mr. Rehman conducted a thorough forensic examination of the defendant's computer, a very old (in computer terms) IBM model PS1. A dozen child pornography files were found on the hard drive. Mr. Rehman's expertise, however, lead him to the inescapable conclusion that the defendant was being framed; the charges against the defendant were dropped.


Mr. Rehman conducted an examination of a computer for child pornography. The defendant admitted to having downloaded "a few" images many months earlier, but claimed he had destroyed them. Mr. Rehman's examination revealed a large cache of encrypted files; he was successful in breaking the password and recovered dozens of child pornographic images the defendant was collecting and maintaining. The defendant pled guilty.


Another computer belonged to a defendant who claimed he had never downloaded any child pornography. The defendant admitted to having deleted numerous files prior to a search warrant, but denied they were child pornography. In examining all of the materials seized, Mr. Rehman found numerous back-up tapes. Numerous child pornographic images were found on the back-up tapes; the defendant pled guilty.