Bryant, et al v. Chicago Public Schools, et al.

Forensic Examination Leads to Perjury Investigatio

2009 U.S. Dist. 2008 WL 4966589 (N.D. Illinois February 12, 2009)

CHICAGO: February 12th, 2009 Forensicon was jointly retained by Plaintiff and Defendants to provide computer forensic expert services. Its analysis and testimony provided information which proved crucial to the opinions set forth by the Court.

Defendant Gardner submitted a printed copy of a letter dated September 28, 2007. This letter purportedly contained information in opposition to one or more of Plaintiff’s claims in this litigation. Defendant Gardner also submitted a sworn declaration under penalty of perjury pursuant to 28 U.S.C. § 1746 that he received said letter on that date.

Forensicon created and analyzed a forensic image of Gardner’s laptop computer and located the letter within the forensic image. The metadata from within the file contradicted the sworn testimony of Gardner.

The metadata indicated that the letter was both created and printed on October 18, 2007, after the Plaintiff filed this litigation. For this reason, the Court determined that Gardner’s statement was false.

The Court opined that because the letter was created and printed after the start of the litigation on Gardner’s own computer, it strongly suggested that Gardner knew his statement to be false. The Court ordered Gardner to show cause as to why the Court should not refer this matter to the U.S. Attorney for potential prosecution.

On February 12, 2009, Judge Ruben Castillo filed an order referring the matter over for further investigation.

The Court additionally opined that the Defendants failed to preserve evidence because Gardner continued to use his laptop computer for well over two months after the onset of litigation.

During the time prior to forensic preservation, multiple file entries were deleted and subsequently overwritten during a notable spike in activity, making them unrecoverable. System processes such as defragmentation also ran during this time period.

The Court stated that “none of these events would have occurred if Gardner had stopped using the laptop, or if Defendant’s attorneys had simply obtained possession of the laptop from him and made an imaging of the computer’s contents, immediately after this lawsuit was filed.”

The Court’s opinion underscores the value of creating full forensic images in as timely a manner as possible. The outcome of this case demonstrates the need for competent, court-experienced computer forensics experts to oversee the preservation, analysis, and reporting of computer-related media.