Dunstan et al v. comScore, Inc.

Filing 269

DECLARATION of Chandler Givens regarding motion for protective order 268 (Attachments: # 1 Exhibit A, # 2 Exhibit B, # 3 Exhibit C, # 4 Exhibit D, # 5 Exhibit E, # 6 Exhibit F, # 7 Exhibit G)(Thomassen, Benjamin)

EXHIBIT A

re
r%

&17 r&2',1 .3',l00

rLY$luH{-

Two Otiver Street, 11th Ftoor

Boston, MA 0?1ff?

ffirffirT&*

www.el.ys.com

Initial Report of Michael Perrv on Review and Expo{t of Information fron
Jeff DuFstan?s Computer Svstem
Scope
I was asked to review the forernic images of two hard drives from a computer used by
Jeff Dunstan in connection with the Dunstan et al v. comscore, Inc,litigation as described in the
October 23,2013 Protective Order covering production of Jeff Dunstan's hard drive. I, and
colleagues working at my direction, reviewed these,images and exported various data and reports
("Retrieved Data") in accordance with the Protective Order.
This report details the "Retrieved Data" to be produced to counsel for the Defendant after
review by Plaintiff s counsel for potential objections to such production.

Forensic Images
Two forensic images were sent to Elysium Digital ("Elysium") on October 25,2013 from
Edelson, LLC. Neither image is included in the Retrieved Data; they are described here as they
are referenced elsewhere in this report and in the Retrieved Data files.

l.

Image Name: EDEL-JDunstanP0
Model: WDC WD2500AAJS-60M0A0
Serial #: Not present in the imaging log files.
Source Data Size: 238475M8
Image Captured: l2l2l l20Il
Imaging Tool: FTK Imager

' 2. Image Name: EDEL-JDunstanPl
Model: ST3160815A
Serial #:9RA72A66
Source Data Size: 152627M8
Image Captured: l2l22l20ll
Imaging Tool: FTK Imager

Analysis Tools
For reference purposes, Elysium used the following software during its analysis:
1

Initial Report of Michael Perry - Dunstan v.

comscore

ffi
r%

61 ?. S? t "31 ,*fi

ILY$IilMs lffi ilY&

o
o
o
'o
o

1

-

*

www"€[y*"ccrn

The following information was extracted from the Windows Rcgistry:

ComputerName:ACER-262DC2EBF3

RegisteredOwner:Lori
ProductName : Microsoft Windows XP
CSDVersion : Service Pack 3
Productld : 7 6487 -OEM-00 I I 903-00 I 00
CurrentBuildNumber : 2600

Buildlab

: 2600.xpsp_sp3_gdr.0 9 1208-203 6

SoftwareType: SYSTEM
SourcePath : C:V386
SystemRoot : C:\WINDOWS
PathName : C:\WINDOWS
InstallDate : Wed Sep3 23:58:03 2008 (UTC)

o
o

Logon Profile:"Lori"
Last Updated: Wed Dec 21 20:40:54 201I (UTC)

Time Zone:

DaylightNams -) Pacific Daylight Time
StandardName -) Pacific Standard Time

Retrieved Data

l.

File Listings

-

File listings were created to include all files found in the forensic images.

These files can be found in the "Filelists" directory. The files included are:

o

ES01 EDEl-JDunstan_Filelist Email.xlsx

-

This report contains all email files found in

the forensic images. The report was compiled using FTK v4.

o

fih FLosr

S*stnn, MA S?tS?

X-Ways Forensics v. 16
AccessData Forensic Toolkit (FTK) va
AccessData FTK Imager
Internet Evidence Finder v6.l
Misc. system utilities

System Information

o
o
o

Two 0liver $tr*et,

ES0l EDEl-JDunstan_Filelist_Files.xlsx - This report contains all files found in the

Initial Report of Michael Perry - Dunstan v. comscore

forensic images, excluding email messages. The report was compiled using X-Ways
Forensic

vl6.

2. Windows Registry

-

The Windows Registry hives were extracted from the forensic images

and included in the "Registry-Natives" directory. The files included are: default,'sam,

security, software, system, and userdiff found at the path "\Windows\system32\config"; and
ntuser.dat found at the path "\Documents and Settings\Lori\".
3.

\ilindows Registry

-

Extracted Data -Data was extracted from each registry hive into text

files, creating a human-readable version of the registry data. These files were named for the
registry hive from which they were created (default.reg.fit, sam.reg.txt, security.reg.txt,
software.reg.txt, system.reg.txt, userdiff.reg.txt, and ntuser.reg.txt) and saved in the
"Registry-Extracted" directory.

4.

Event Logs

- All Windows event logs containing data were extracted from the forensic

images as found at the path "\Windows\system32\config" and included in the "Event-

Logs_Natives" directory. The files included are: AppEvent.evt, OSession.evt, and
SysEvent.evt.

). Event Logs - Extracted Data - All

data was extracted from each event log into text files,

creating a human-readable version of the event log data. These files were named for the
event log from which they were created (AppEvents-exported.xlsx, Osession-exported.xlsx,
and SysEvent_exported.xlsx) and saved in the "Event-Logs-Extracted" directory.

6.

Internet History

-

Internet history artifacts were extracted from the forensic images using

Intemet Evidence Finder (IEF) v6.1. These reports were saved to the "Internet-HistoryExtracted" directory.

These reports include:

o
o
o

Browser Activity,csv
Chrome Web History,csv
Chrome-360 Safe Browser Carved Web History.csv

Initial Report of Michael Perry - Dunstan v. comscore

o
o
o
o
o
o
o
o
o
o
o
o

Firefox Bookmarks.csv
Firefox Cache Records.csv
Firefox Carved Web History.csv
FirefoxDownloads.csv
Firefox FormHistory.csv
Firefox Web History.csv
Internet Explorer Cache Records Carved.csv
Internet Explorer Cache Records.csv
Intemet Explorer History.csv
Internet Explorer Leak Records.csv
Opera Web History.csv
Parsed Search Queries.csv

7. LogX'iles - Log files found in the forensic

images were extracted and included in the

o'Log-

Files" directgry. The original path of these files was recreated in the o'Log-Files" directory.
The "Log-Files" directory also includes a file "MBAM-log-2013-10-30 (0g-25-44).txt",

which is a log file created by Malwarebytes as the result of a scan against the forensic images.

Retention of Copies of Forensic Images
In accordance with an agreement between the parties, Elysium Digital will retain the
copies of the forensic images made for the analysis and in the production of the "Retrieved

Data". These forensic images will be stored in a secure location at Elysium's office, and will not
be reviewed or shared, unless by mutual agreement of the Parties, or an order from the Court.

The original image provided to Elysium will be returned to counsel for the Plaintiff with
this report.

SIGNED UNDER THE PENALTY OF PEzuURY THIS

Michael Perry

Initial Report of Michael Perry - Dunstan v, comscore

3I

st day of

October,20l3.