To learn more about our e-discovery,
computer forensic, forensic accounting or computer security services or
discuss a specific matter
In a Federal False Claims case involving prescription fills and refills by a pharmacy benefits manager traditional analysis methods had proved ineffective at finding instances of non-compliance. Fordham advised counsel about how computerized auditing techniques could be used to perform a hundred percent audit and find the non-compliant transactions without having to use the defendant's software or duplicate its computer systems. In the process Fordham advised counsel on the forms of ESI that would be required and how such data should be described and requested in Rule 34 production requests for electronic data.
The data that was produced as a result of the production requests, involved more than 30 database tables containing over 1 billion rows of data and representing production data for more than 100 million prescription fills and refills with their related billing data.
Fordham reviewed contract requirements to understand the performance requirements, the basis for penalties and establish an auditing baseline. As a result of his review, Fordham designed software tools to:
While the defendant had claimed its compliance errors were few and amounted to only about $8,000 in penalties, Fordham's computerized audit uncovered several hundred thousand compliance failures that resulted in a settlement of over $150 million, which, at that time, was one of the ten largest healthcare recoveries under the False Claims Act. (back to top)
In what started as a tortious interference complaint lodged by a former employee, Fordham was provided with the former employee’s laptop computer that he improperly took with him at his departure and did not return until after the former employee's first deposition. Fordham was asked to search the computer's contents for documents meeting certain search criteria of trade secrets.
Fordham's efforts uncovered numerous deleted files and e-mails evidencing considerable usage of the machine after the former employee’s departure despite his representations to the contrary. In fact, the recovered data evidenced date markings in e-mail chains extending up to just prior to the computer's production. Interestingly, the active data and file system depicted only occasional usage of the machine over the two years prior to its production.
One of the deleted items recovered was the log file of a wiping program memorializing the names of files that were of considerable interest to the litigation. The timing of the file wiping as memorialized in the log file coincided to the submission date of the former employee's interrogatory answers claiming that those files did not exist.
Apparently, all of the evidence items that were recovered had not only been deleted prior to the computer’s production but the entire drive had been reformatted and its state returned to that captured in a system backup performed years prior. The system clock was then changed to a few different dates during the intervening period and minimal operations performed in order to provide the look of limited usage.
As a result of Fordham's findings and the former employee’s feeble explanations, like the wiped data was of no substantive value, the Court granted our client’s motion for sanctions, entered a default judgment in favor of our client’s counterclaim, and dismissed the former employees claims with prejudice. (back to top)
In a SEC investigation Fordham forensically imaged 45 computer hard drives and restored 40 backup tapes in order to locate documents and e-mails meeting keyword search terms and date limitations.
Files meeting the criteria were produced in Concordance load files containing native documents, fully extracted text and metadata as well as other attributes specified in the government’s production request.
Non searchable files were converted to searchable formats including password protected files whose protections were removed prior to searching. (back to top)
A client became suspicious that their network had been hacked and someone was accessing and reviewing confidential information. Fordham confirmed that someone was indeed accessing their network. There was no malware, however. Rather, Fordham tracked the activity to a particular user account and removed it. During subsequent activity monitoring the account came back, however. The activity monitoring revealed that the account was being created through a trust that existed between the client’s domain and another domain. The trusted access was being used to re-access the network and re-create the user account even after the account had been removed and deleted. The trust had been created during a prior period domain migration. It had never been broken and was now being used by a former employee for mischief. (back to top)
In a $60 million construction claim involving an EPA Superfund cleanup site, Fordham reviewed the documentation produced by the remediation contractor to support their claims for contract changes and delays and advised counsel on the forms of Electronically Stored Information (ESI) likely used by the contractor to quantify its claims and produce the related documentation that supported each of their claims. Fordham also advised counsel about how the data should be described and requested in discovery requests for the contractor's ESI at the corporate level, the project level and for other organizational subsidiaries that had participated on the project.
When the requested ESI data was produced Fordham determined that the productions of electronic data were incomplete. Fordham advised counsel about the indicators of the incomplete data and the kinds of deposition questions, interrogatory questions and request for admissions that should be asked in order to support motions to compel for production of the missing data along with source code and object code for the contractor's specially developed quantification system.
Analysis of the complete ESI data along with source and object code used by Plaintiff's custom claim quantification system revealed that the data had not been prepared contemporaneously as represented by the Plaintiffs and characterized as business records. In addition, Fordham's examination of the software code revealed that certain costs claimed were not based on costs incurred as claimed. Rather, they were based entirely on calculation and were over and above costs actually incurred. In addition, Fordham found that certain costs had also been claimed up to 9 different times as part of disputes that had been settled with other parties on the project, including the contractor's subcontractors, and that the amounts included in claims against the owner included the difference between total amount that had been claimed against the other parties and the amounts that had been reached in settlement with these other parties.
When examining the produced copies of certain source documents there were frequently obvious differences in presentation of the data. When these documents were compared to the corporate ESI, it became obvious from system metadata that the presentation differences corresponded to accounting entries made years after the fact during the claim development process and not contemporaneously as the contractor had represented.
Fordham devised a means to use the Plaintiff's own ESI claims data to perform a 100 percent audit of their claim quantification. Fordham's computerized audit identified claimed costs that were considered unallowable by the contract terms. The audit also reconciled costs claimed to actual costs incurred and corrected for costs that were "double counted". Fordham also noticed that costs allocated to the base contract work were not work related at all. Instead, the base contract had simply become the cost objective to which unallowable administrative costs had been allocated--presumably under the notion that since base contract effort was not in dispute it would never be analyzed. So, the contractor had essentially characterized allowable costs as changed work while characterizing unallowable administrative costs as base contract in order to sustain a higher claim recovery when only the type of costs was considered.
As a result of Fordham's computerized audit work, the Plaintiff's claim was reduced from 60 to 20 million dollars before consideration of liability and causation issues. (back to top)
Fordham was retained to examine personal computers, network servers and other storage devices for instances of a former employer’s documents at the new employer and then remove them in accordance with a court ordered protocol.
Over a weekend Fordham examined nearly 200 devices using proprietary programs that cataloged file system metadata and file hashes of each machine's contents. Those results were then compared to a library of nearly 200,000 documents of the former employer. The process identified about 20 machines, including servers, of the new employer that contained thousands of instances of the former employer’s documents. Those machines were then imaged and subjected to more comprehensive forensic analysis.
More detailed examinations of the machines having documents with matching hashes revealed that the matches were comprised of both proprietary and non-proprietary documents of the former employer. Interestingly, even the non-proprietary documents were stored in file paths matching those of the former employer that included unique folder names like clients, completed projects and current employee names of the former employer. (back to top)
In a trade secrets case, the Court granted Fordham 90 days to access more than 13 terabytes of the defendant’s computerized data to search and produce evidence of purloined trade secrets.
In that effort Fordham forensically imaged 20 computer hard drives, restored 80 backup tapes and then searched and examined millions of documents and over 9 million e-mails with attachments for active, deleted and modified versions of trade secret documents and information that had been retained and used despite the defendant’s representations to the contrary. (back to top)
A bank employee e-mailed Personally Identifiable Information (PII) about mortgage holders to their home e-mail address just prior to their departure for a new job. Fordham reviewed their historical computer activity including e-mail, attached devices and other data transfer and storage methods and determined that this instance was the only one that had occurred and that the amount of PII that was being sent was too large for the e-mail system and that it had become hung without ever leaving the bank's network. (back to top)
In a trade secrets case Fordham was selected as the neutral e-discovery expert. In that capacity we collected, preserved and searched the ESI of both parties on about 40 machines that equaled about 6 terabytes of data.
The search was conducted in accordance with a consent order formalizing the search protocol that included active and deleted space as well as all document types. Unsearchable files were converted to a searchable format and protected files were unprotected so that they could be searched.
After filtering the search results to exclude unlikely document types, we produced over 100,000 documents and e-mails for each side. The documents converted to about 3 million TIFF image pages. The image files, native files, extracted text, extracted metadata and various other attributes were produced in Summation load files. (back to top)
When a Fortune 500 defense manufacturer had the design requirements for its hardware changed the resulting development effort delayed manufacture of the delivered hardware for three years. Remarkably, the most significant of the many design changes, transformed the hardware's qualification requirements from state-of-the-art to beyond state-of-the-art and commercially impractical.
Quantification of damages began with proof of entitlement resulting from the changed requirements caused by customer imposed new requirements, breach of implied warranty of specifications, and differences in interpretation. While the increased engineering effort caused by the design changes was challenging, the consequence of those changes on quantification of delay damages was very complex and required proof of fixed versus variable costs, justification of unmitigated costs, justification of standby and proof that replacement volumes were not complete substitutes for the delayed work.
Fordham quantified the delay damages as high as $36 million. He used his advanced cost modeling capabilities to develop a parametric approach that calculated the effect of the nearly 400 changes on the design effort was to add more than three years and 100,000 man-hours to the design and development process. Fordham selected this approach after demonstrating that more traditional methods, such as CPM [Critical Path Method], were inappropriate in this particular circumstance.
The results of engineering calculation were then linked to another model designed by Fordham that replicated the company's manufacturing system and calculated the extended period fixed cost consequence of the engineering changes and related damages. (back to top)
As the recompetition for a large, multi-year government contract approached, an ambitious competitor enticed the incumbent's program manager to switch companies.
After leaving the incumbent for an unspecified opportunity, Fordham examined the computer of the former employee and found that four thumb drives had been used to copy pricing data along with other staffing and management plans of the incumbent for the follow-on contract.
Web based e-mail communications were also retrieved from the Windows swap file that revealed weeks of exchanges between the former employee and management at the new employer regarding the recompete and a presentation meeting about the recompete's capture strategy that was planned a few days after the departure of the former employee.
After examining imaged hard drives of the new employer's management team, Fordham determined that files of interest had been shared on several other thumb drives between the former employee and the new company management. Fordham was also able to determine that critical media such as personal computers of key personnel, external storage media like hard drives and the shared thumb drives, and network servers containing files of interest had not been preserved despite specific and expressed instructions in a preservation letter.
The jury awarded our client all of its requested trade secret damages. (back to top)
In a wrongful termination case the terminated employee developed a counter claim for uncompensated overtime for work performed at home on his personal computer. The employee was asked to deliver his computer for forensic examination in order to validate his claims.
Fordham detected numerous anomalies in the hard drive artifacts that suggested a recently constructed device with a prepared presentation.
At deposition the former employee was questioned about Fordham's findings. With each explanation subsequent anomalies became harder and harder to explain. Finally, the employee admitted that this was not the original drive on which he had performed his work. In fact, he had been so concerned about the forensic examination that the original drive had been physically mutilated, deformed and then melted with a blow torch. (back to top)
The network of a doctor’s office was left unprotected and was thought to have been hacked by an outside entity based on unusual system activity. Fordham was asked to review the network and determine whether the network had been hacked and whether Protected Health Information (PHI) had been compromised. While Fordham was able to confirm the system had been breached there was no indication that PHI had been compromised. (back to top)
In a construction claim involving power generation, the Plaintiff detected omissions in the owner’s document production. Fordham was retained by the owner to review the originally collected electronic data, the Concordance database and production efforts performed by the owner’s e-discovery vendor, including processing logic and production tools, to identify document omissions.
Any shortcomings were then cross referenced against the Plaintiff's productions as well as those by third parties in order to identify those omissions that actually could have resulted in prejudice. Hash comparisons of omitted documents to produced documents were widely used as a basis to differentiate substantive omissions from non-substantive omissions.
We even developed software that could be used by the owner to evaluate for relevance and privilege document ranges identified by the Plaintiff as containing potentially missing documents. (back to top)
Fordham prepared the termination settlement proposal for a Defense 10 contractor after the client’s cost plus award fee contract was terminated for convenience after three years of performance but after only achieving the first milestone award.
Fordham had been one of several selected for a presentation to management about their assessment of the best means to recover the client's profit. After all, as a cost type contract the client had received their costs but not any fee beyond the first milestone. Since the profit was back loaded on contract performance the first milestone award fee had been minimal.
Fordham's approach was very different than the other presenters (two law firms specializing in government contracts and a national consulting firm) but then Fordham was the only presenter who knew that recent court decisions on terminated award fee contracts were contrary to the approaches proposed by the other presenters. Another big plus for the client when they asked about "bait and switch" was Fordham's response that if they hired him they would get him.
When justifying the client's entitlement to additional profit, Fordham recognized that the project had been delayed about three years as a result of customer directed design changes and delinquent customer deliveries of design data. The changes and delinquent customer deliveries entitled the client to equitable adjustments in the contract price and schedule under various contract adjustment clauses.
Fordham quantified the amount of delay damages under the Eichleay formula, which is currently the exclusive means for quantifying delay damaging in Federal contracts, to be about $2 million. Because of the nature of delays, those costs would not have been recovered in the client's normal cost based billings. So, in addition to additional profit from the equitable adjustment the client was also entitled to additional costs.
With respect to the changed work itself, while the client had received the costs for the various design changes as part of the reimbursable cost of the cost plus award fee contract, the client had not been compensated for any fee that would be part of that equitable adjustment. Fordham quantified the additional fee at about another $2 million for the additional profit that was part of the "equitable adjustment" provided for under the various entitling contract clauses.
With respect to the termination itself, in keeping with accepted quantification methods, Fordham identified about another $2 million of unamortized indirect fixed costs and included those as settlement expenses.
Since the client performed a lot of other cost reimbursement work, the reallocation of delay costs as well as reallocated costs to the terminated contract increased room on other cost type contracts constrained by limitation of cost and limitation of funds provisions.
With a termination settlement proposal exceeding $6 million, including undefinitized constructive changes, the client was able to settle its proposal for several million dollars which was considerably more than the client had expected after receiving its termination notice. (back to top)
In a trade secrets case the former employer's expert had opined that the former employee had created CDs of company proprietary data prior to returning the computer.
Fordham reviewed the expert's report and the evidence he had considered. Fordham determined that the expert had misinterpreted the CD drive activity and that other artifacts related to the files in question actually confirmed that the files had not been copied at all.
At deposition and when questioned about the meaning of the other artifacts and the meaning of CD drive activity, the expert withdrew his opinions. (back to top)
After examining the hard drive of a laptop used by a former employee at its new employer, Fordham detected that a key pricing model of the former employer existed on a USB flash drive and had been viewed from the new employer's laptop.
When the flash drive was produced it was completely filled with vacation photos. Fordham was able to confirm that, while taken several years before, the photos had been placed on the flash drive in the time between the device's production request and its actual production.
In addition, when other computers were produced, Fordham was able to confirm that the same USB flash drive had been used on those computers as well and the pricing model that had existed on the drive had been viewed. Most important was that while the new employer had developed its own pricing model, the timing of the former employee's view of the former employer's pricing model was while developing bids on new projects while using the new employer's pricing model. The former employer's pricing model was being used to validate the new employer's bids on new projects. (back to top)
A Fortune 500 defense manufacturer had seen its fixed price production contract switch from profitable to a loss position at around the midpoint of performance when an engineering design review had also occurred.
Although the design review occurred prior to the manufacture of any equipment, the evaluation was conducted at a level for reproducible, manufactured products and resulted in over 11,000 review comments from the customer's design review team. Fordham used statistically sound methods to select a sample, review the comments and project their results to the population. Through this method Fordham determined that over 90 percent of review comments exceeded the inspection standards applicable to the product at that point in development
The result of the excessive inspection increased the client's review and formal disposition of the comments. It also caused needless engineering effort since as actual production of the early prototypes occurred the results of numerous comments had to be totally redone.
The effect on engineering was not the only consequence of the excessive inspection. The customer's design review and creation of the 11,000 comments took several months longer than allowed under the contract's performance schedule. In fact, a stop work order was issued to provide the customer with time to create the 11,000 comments.
After release of the comments and resumption of performance no schedule extension was issued for the months of delay while conducting the design review. In fact, the work was even resequenced by the customer so that manufacture of completed units occurred prior to design completion and qualification acceptance testing. The lack of schedule extension was a constructive acceleration and the resequencing of the manufacturing prior to final design qualification caused considerable rework of completed units.
Fordham quantified the consequence of these constructive changes and their related delays, disruptions and inefficiencies at around $13 million for which the client was able to negotiate a substantial settlement. (back to top)
An opposing expert was asked by opposing counsel to examine application metadata of certain electronic documents and opine that their create dates post dated the expiration of a former employee's non-compete and intellectual property ownership agreement. While the create dates confirmed their creation after expiration of the non-compete and intellectual property ownership agreement, Fordham noticed that other metadata indicated that the documents had actually been inherited from ones covered by the non-compete and intellectual property ownership agreements. In other words, when creating the documents in question the former employee had started with these earlier documents, made changes to them and then saved the results in a new document name.
At his deposition the opposing expert was not familiar with the significance of the other application metadata that revealed the historical lineage of the documents. He had been asked by opposing counsel for an opinion with a very limited scope, which he claimed was all that he was providing.
As a result of the weaknesses in the opposing expert's findings and since the data used in his analysis was actually supportive of our client's claims, his report was never used by opposing counsel and he never testified at trial. In the end, therefore, his work did not advance their case and one could say that he cost too much. (back to top)
In a securities fraud matter, Fordham was retained to review the computer systems of the securities firm and assess those worthy of preservation and likely containing responsive data.
The secure nature of preserved data required extensive identification and decryption of encrypted files and e-mail attachments so that they could be searched for documents responsive to agreed protocol criteria. In addition, there were very tight schedule limitations that were challenged by slow performing, third party appliances on which the securities firm has stored its data to meet SEC data retention requirements. (back to top)