When the Eraton Detective Bureau of Jackson, NJ was hired to investigate a possible case of software sabotage, they brought me in to work side-by-side with their private detectives to perform a forensic analysis of over 100,000 lines of mainframe source code. The impacted company produced yellow page directories for the New York tri-state area. A few weeks earlier they terminated a non-performing employee. The employee was a mainframe programmer. While out one night drinking with some of his ex-coworkers, he mentioned that he left a surprise for his employers that they would learn about in another week or two. He never specified what the surprise was, but the ex-coworkers suspected a software time bomb.
When I arrived at the location I was handed hundreds of pages of source code printed on an old dot matrix printer. It was hard to read and much of it looked like gobbledegook. I buckled down and started reading. After a few days of this eye-straining, headache producing work, I spotted a line that didn’t appear as though it fit with the rest of the code. I started tracing the code from this line and within an hour was able to document what this guy had done. He very carefully injected code into this program that would have deleted all the data off of the company’s storage array at midnight in another few days. He literally would have put them out of business. They did not have a disaster recovery plan in place. They relied on a full storage backup that was over a year old plus their nightly backups. To save time each night, they only did incremental backups to tape. If the bomb had exploded, it would have been a disaster trying to recover all of their customer and accounting information.
Once I walked the detectives and company officials through the source code, they called in the police. The gentleman was arrested on criminal charges and eventually convicted in a court of law. He went to prison. My work in the case as a forensic investigator and expert witness proved to be the essential element that won the conviction. I have worked with many attorneys over the years and have appeared in court on numerous occasions. If you need an expert witness or forensic IT investigator, I’m your man. Call me and let’s discuss your case. My expert witness rate is industry competitive.