The Financial Broker – Website information found in unallocated space

A client for a financial broker lost a significant amount of money when the stock market fell and claimed $4.5 million in damages.  The client claimed that he tried to move his funds into safer products on the brokerage website but the website was down when he attempted to log on to the site.  The suit was filed two years after the client’s claimed loss and to make the situation more difficult the client’s computer was heavily used by his family throughout the two years.

The brokerage firm and its outside counsel engaged the Center for Computer Forensics to examine the computer.  The Center for Computer Forensics met with the firm’s Webmaster and created a keyword list including account numbers that would assist to determine if  the client was indeed logged on to the site.  The examination was to determine if there was any indication that the secure website had been accessed from the client’s home computer at the time the client’s accounts lost their value.

The account numbers produced a match in unallocated space that was determined to be the bottom of the secure website deleted from internet cache.  The page plainly showed the customer account number and a date during the period when the client claimed damages. The financial broker’s Webmaster verified that this could only have come from the secure web accessed with the client’s user name and password thus proving that the client had access to his funds during the time of the alleged loss.

The Center for Computer Forensics testified at an arbitration hearing on the findings.  Opposing counsel produced an expert that claimed that the data from unallocated space meant nothing and should not be considered. The Center for Computer Forensics'  testimony was accepted as accurate and the three member panel ruled in favor of the financial broker awarding no damages.  Furthermore, the cost and fees were reduced to 40% for the financial broker based on the strength of the evidence presented.