CERTIFIED COMPUTER INVESTIGATOR EXPERT WITNESS

EDUCATION AND CERTIFICATIONS

University of Kentucky / Lexington Community College - Associates Degree in Applied Science

Kurzweil Voice for Windows Training and Voice Med. Training - Waltham, MASS.

2-week extensive MCSE Boot Camp (1999)
MCP (Microsoft Certified Professional)
MCP+I (Microsoft Certified Professional + Internet)
MCSE (Microsoft Certified Systems Engineer)

Microsoft Windows 95 Boot Camp

Microsoft Technical Seminars

Intel Seminars and On-Line Training

Hewlett Packard online training and tests

Self-taught Network + - Network + Certified

Self-taught A+ - A+ Certified

High Tech Crime Investigator Level II Training (2003) - Investigator Level II Certification

Association of Certified Fraud Examiners Training "Investigating By Computer" (2003)

5-day Forensic Boot Camp (CCE Prep) (2004) - CCE/Certified Computer Examiner

(Other Certifications Available upon Request)

AWARDS

The Army Commendation Medal
The Army Achievement Medal
2 - Honorable Discharges from the United States Army 1981 / 1986
Kentucky Colonel

(Other Awards Available upon Request)

EXPERIENCE

Teaching Experience

Lectured for the University of Louisville Speed JS100 Course

Lectured for the Kentucky Technical Schools MCSE Course

Lectured for the Kentucky Legal Nurses Association

Lectured for KY Attorney Generals Office investigators and attorneys (Medicaid Fraud Division / Public Corruption)

Performed CLE Training Session for the Trial Defense Counsel for the US Army (TDS Region VII & VIII Spring Conference 20-23 May 2002)

Performed CLE Training Session for the Kentucky Civil Defense Counsel annual seminar - 2003 in Louisville KY

Conducted the CLE Training in Forensic Computer Investigations for Federal Public Defenders Office Cheyenne, WY - Nov. 2003 (Tom Fleener)

Lectured for KY Attorney Generals Office investigators, attorneys, technicians (Consumer Protection Division)

Performed Training Session for the Trial Defense Counsel for the US Army (TDS Region III Spring Conference April 2005, Kansas City, Missouri, LTC. Bradley), my presentation is called "Basic Training in Computer Forensics"

Related Experience and Expert Witness Cases
(Full Case List Available upon Request)

1988 - Present, General Manager / Technician, MCA, Inc., Lexington, KY
Design computer systems and servers, Passed multiple tests from HP/Compaq to be authorized to work on their specific computer equipment, Microsoft OEM/VAR/System Builder Programs / Microsoft Partner, Installed Novell server operating systems.

Work(ed) with Microsoft products and operating systems: DOS, Windows 2.x, Windows 3.x, WFW 3.11, Windows 95 a & b, Windows Office Products 95-97-2000-2002-2003, Windows 98 1st and 2nd Editions, Windows ME, Windows NT 3.51 and 4, Windows 2000 PRO, Windows 2000 Server, Windows XP Home / XP PRO, and now Windows 2003 Server.

1999 - Present, CA, Inc., Computer Forensic Examiner / Expert Witness / Consultant Lexington, KY
Maintain a lab that allows a 24hour round the clock work force for large data harvesting projects/cases.

Sworn in as an Expert Witness in Forensic Computer Investigations and Data Retrieval in Federal and State Courts

I have used and currently used EnCase versions 1, 2, 2Pro, 3, 4, 5, AccessData Ultimate Forensic Toolkit, FastBloc FE, AccessData Password Recovery, Active UnEraser, R-Studio, X-Ways Forensics, ISOBuster as well as other tools and utilities.

I conduct interviews with individuals to see what they say they experienced

I prepare PowerPoint presentations for trials, training and speaking engagements

I perform deposition consulting

I have retrieved data from various types of media: SanDisk, CD/CDRW/DVD, Hard Drives, Floppy Disks, Zip, Firewire - USB Hard Drives and Jazz Disks etc .

Data Retrieval/Analysis (private family - showing credit card spending by son)

Imaged Lotus Notes Mail Servers, Exchange Mail Servers in different regions of the US

Data Retrieval/Analysis (Divorces, Civil, Private School A.U.P., KY D.O.T. A.U.P.)

Harassing Communications Case

Child Porn Case (Evidence Review)

Data Retrieval/Analysis Data Retrieval of deleted information or missing data due to viruses, system crashes, etc

Child Porn Case Federal Public Defenders Office

Secure Data / Email Resurrection-Recovery and Analysis (Mail Servers, PC's, Notebook)

Embezzlement (private) - Turned evidence over to the local police.

Child Porn Case - (State Public Defenders Office)

Wrongful Termination / Breach of Employment Agreement (private/civil)

Secure Data / Analysis of media

Child Porn Case - Data Retrieval / Analysis / Evidence Review) (local police)

Retrieval/Analysis on a client's employee computer system to see if AUP was broken.

Data Retrieval/Analysis of hard drives that have been formatted (Divorce Case)

Data Retrieval/Analysis of hard drive to search through correspondence (Divorce Case)

Tracked and recovered emails sent via ship PC via satellite to receiving systems and servers

Forged Email - Family Court, was able to show email was fabricated and could never have been sent by defendant.

Assist in internal HIPAA audit for a University

Consult attorney - acquire media - perform analysis of acquired media

Data Recovery of deleted financial records and hard drive appeared to have been restored from manufacturers' settings - retrieved Intuit Quickbooks Pro company record - .QBW file.

Data Recovery - recovered all E-mail files that were deleted after the manufacturers' restore CD had been used

Data Recovery - 1gb MicroDrive - recovered images deleted from drive

Secure Data in Search and Seizure / Analysis Consult attorney in case

Recovered data from failed "stripe set" on system Consult attorney in case

Consult attorneys - secure data - image and clone media - analyze data from keyword searches

Consult attorney / secure data (civil) (Manager 600+ man-hour data harvesting project)

Consult attorneys - secure data - analyzed data flow - report findings

Consult attorneys / Acquired Server / Acquired Workstation / perform data analysis and reporting in case (civil)

Consult attorneys in case / acquire electronic media / analyze data from search hits supplied

Consult attorney in case / perform evidence review (Trial Consulting)

Consult attorney in case / review-recover data from electronic media- acquire media

Consult attorney in case - review videos and print expanded images Data Recovery from USB JumpDrive for attorney

Consult attorney in case / perform data acquisitions - analysis / evidence review Data Recovery on SATA drive using Tableau write block through EnCase

Consult attorney / perform data acquisitions - analysis / evidence review Data Acquisition/ Secure Data / Establish and Document Chain Of Custody of electronic media and systems

Consult attorney / secure data / evidence review / analysis Consult attorney / Secure Data / Document Chain-of-Custody Consult attorney / evidence review (Trial Consulting)

MEMBERSHIPS

Certified Computer Examiner (CCE)

Member ISFCE (International Society of Forensic Computer Examiners)

Associate Member of Association of Certified Fraud Examiners

Member High Tech Crime Network

Elected to the Executive Board of Directors for Central and Eastern KY Better Business Bureau - Corporate Secretary 2003-2004

Elected to the Executive Board of Directors for Central and Eastern KY Better Business Bureau - First Vice Chair/Chair Elect 2004-2005

Elected to the Executive Board of Directors for Central and Eastern KY Better Business Bureau -Chairman of the Board Elect 2005-2006

Appointed to the State of Kentucky's Technology Task Force (1999)

Judge for the Kentucky Technical High School Computer Repair Contest

CIS (Computer Information Systems) Advisory Committee for Lexington Community College

Lifetime Membership Disabled American Veterans (DAV)

Member of The American Legion

KEYWORDS

Computer Expert Witness, Investigator Expert Witness, certified Expert Witness, HP/Compaq Expert Witness, Microsoft OEM/VAR/System Builder Programs / Microsoft Partner Expert Witness, Novell Expert Witness, Microsoft products and operating systems: DOS Expert Witness, Windows 2.x Expert Witness, Windows 3.x Expert Witness, WFW 3.11 Expert Witness, Windows 95 a & b Expert Witness, Windows Office Products 95-97-2000-2002-2003 Expert Witness, Windows 98 1st and 2nd Editions Expert Witness, Windows ME Expert Witness, Windows NT 3.51 and 4 Expert Witness, Windows 2000 PRO Expert Witness, Windows 2000 Server Expert Witness, Windows XP Home and PRO Expert Witness, and now Windows 2003 Server Expert Witness, Forensic Computer Investigations Expert Witness, Data Retrieval Expert Witness, Federal Expert Witness, State Expert Witness, and Military Courts Expert Witness, EnCase versions 3 and 4 Expert Witness, AccessData Forensic Tool Kit Expert Witness, AccessData Password Recovery Tool Kit Expert Witness, QuickviewPlus Expert Witness, ACDSee Systems Software Expert Witness, Logicube CloneNow Expert Witness, FastBloc FE and IDE Expert Witness, S-Tools Expert Witness, Data Retrieval from various types of media: SanDisk Expert Witness, CD/CDRW/DVD Expert Witness, Hard Drives Expert Witness, Floppy Disks Expert Witness, Zip Expert Witness, Firewire - USB Hard Drives and Jazz Disks Expert Witness, Imaged Lotus Notes Mail Servers Expert Witness, Exchange Mail Servers in different regions of the US Expert Witness, Performed CLE Training Session for the Trial Defense Counsel for the US Army Expert Witness, Child Porn Case Expert Witness, Wrongful Termination/Breach of Employment Agreement Expert Witness