Summary:

A confused and shocked wife contacted International Counterintelligence Services, Inc. For over ten years she had been happily married to a man without really knowing his true colors. She had recently noticed him acting differently. He had been secretive with the contents of the family’s personal computer. While the husband was out of town on business, she found a memory device that she had not seen before. Out of curiosity, she decided to look to see what was on it. Shocked at the graphic content she found on the device, she was even more horrified when she found nude pictures of her among the images. The wife feared that the husband might have been posting images of her on the Internet. She felt hopeless. She had no idea who this person was, a person who would betray her trust in this way and permit these types of pictures around their children. During her consultation, trained case analysts and investigators at ICS were able to assess the urgency of her matter and put together a solid action plan to put her at ease.

Because she of the explicit images on her husband’s computer storage device, the client was extremely embarrassed and wanted the matter handled very discreetly. She was also frightened and unsure of how her husband would react if he found out that she had gone to a private investigator. She was beside herself thinking that there was a possibility that some of these images might even have been made public on the Internet.

During the free consultation, she was informed about the possible options. The ICS case analyst, working in conjunction with the investigators and forensic technicians, was able to advise the client on the best course of action. In this case, the only way to know whether or not there were any more images--and if they had been made public--was to obtain the family computer and have it forensically analyzed for any evidence that this had taken place. More often than not, this analysis can become a complicated situation. Many times the computer that needs to be analyzed must stay at its original location and cannot be brought into a lab best suited for the work. In that event, the forensic technician must “image” the subject computer covertly so as to not disrupt the data or tip off the subject of the investigation. This was, thankfully, not the case here, and the client was able to bring the family’s computer to International Counterintelligence Services, Inc.

The forensic analysis began with a through physical examination of the subject computer. This was done to ensure there were no obvious devices attached to the computer that might compromise the integrity of the computer or the lab environment. Then all critical information concerning the computer – make, model and all serial numbers – was documented and digitally photographed. Once the subject computer had been inventoried, the hard drive was removed and a similar process of documenting the critical information was performed. Once all the important hardware documentation had been recorded, it was time to forensically “image” the subject computer’s hard drive. ICS technicians prepared a forensically identical image of the subject hard drive on a new hard drive that had been “wiped” to ensure no trace of any information could be on the new imaged hard drive other that exact or identical copy of the subject hard drive. Once this was achieved and verified to be an exact copy, the subject hard drive was returned to the client’s computer.

Conclusion:

Once this portion of the forensic investigation had been completed the case manager was in contact with the client to give an update on the progress and let her know that she could pick up the computer. Now that the technician was able to open the subject hard drive in a forensically safe environment, he was able to perform the full investigation. It began by taking a full inventory of the all software and files on the hard drive. This can help the investigator and the client narrow the scope of exactly what they are looking for. In this case it was quite simple in that the wife, our client, needed to know if there were any images of her on the computer, and if they had been uploaded to any Web sites. The technician was able to discover all the deleted, non-overwritten images, in addition to following a trail of Internet history and Web cache files. All the discovered information was compiled and reported to the client in a timely and discreet manner. With a report in hand, the wife was able to breathe a sigh of relief that she had the knowledge of what was going on in her own house and could confront her husband in confidence, without making a big mistake.

What to do next:

If you are facing a similar situation or looking for any type of investigation to be done, contact us for a free consultation. No case is too big or too small, we will work with you to get the same positive results. Our licensed and trained professionals are on call 24 hours a day at toll free (800) 828-9198 or you can also contact ICS online.