Latest / Parsing the Truth: One Byte at a Time / Part 1: Printed Emails aren't Digital Evidence

Transcript

Part 1: Printed Emails aren't Digital Evidence · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One Bite at a Time, where we focus on the digital evidence
0:56
in today's modern crimes. I'm Stacey Eldridge and as
1:00
always I'm joined by my Co host Becky Passmore.
1:03
Hello everyone. Becky, what are we?
1:05
Going to talk about. Tonight, well, tonight we're
1:08
going to talk about a case that was featured on another podcast,
1:10
but we love it because we think it has a lot of lessons for
1:15
digital forensic examiners, lawyers, prosecutors, and
1:19
defense, defense attorneys alike.
1:21
Stacey, let's get up to speed. What are we going to do?
1:23
Yeah. So I was listening to another
1:25
podcast the other day and the name of this podcast is another
1:29
Not Guilty. And the specific episode I was
1:33
listening to and just fell in love with was called Proof
1:36
Beyond a reasonable print Out. And we'll link to it in the show
1:40
notes if you want to get more details, like all the details
1:44
because they have the lawyer that was the defense attorney on
1:48
that podcast talking all about it.
1:50
But I bring this episode up because the e-mail situation in
1:55
it is wild, so I want to walk you through what happened.
1:59
All right, I'm ready. Let's go.
2:01
All right, so start simple enough.
2:04
A mother and a daughter walk into a police station with about
2:07
60 pages of Gmail emails printed out.
2:12
And they were not e-mail messages between two people.
2:17
They were actually Twitter preview messages like you get
2:21
Adm sort of situation and that and Twitter sends you an e-mail
2:25
wait. Like what do you mean?
2:27
Yeah, let me be more clear. OK, So you know in Twitter,
2:31
besides being on, besides tweeting to each other, I don't
2:35
know what they call it now an X, but I'm old, so it's Twitter and
2:37
you tweet. But anyways, in addition to
2:40
being able to tweet, you can send someone ADMA direct
2:43
message. And if you have it set up in
2:46
your settings, then you will get an e-mail notification that so
2:50
and so sent you Adm, and then there's a little preview in it
2:55
with a little bit of what the message said, depending on how
2:58
long it was. OK, So what?
3:00
What was in these previews? So mostly emojis.
3:04
Now, sending emojis is not a crime, but we're we're going to
3:08
get into that. So they were sent late at night.
3:11
A lot of them were sent really late, like 3:00 AM.
3:15
There was smiley faces, heart emojis, that sort of stuff.
3:18
But the timing was kind of the most important concern at this
3:22
point because the messages were coming from her stepfather, you
3:27
know, late at night, 3:00 AM. And according to the daughter,
3:32
her stepfather had started a sexual relationship that would
3:36
have went on with her for years. And this was taking place inside
3:40
the home. And now just to make everything
3:43
kind of easier to follow, I'm going to call her the
3:45
stepdaughter because as we talked through this case, that's
3:48
her relationship to the subject. Hi. 3:00 AM Messages to a minor
3:55
coupled with sexual exploitation accusations.
3:59
That's pretty bad. What did the police do?
4:01
So they sent a preservation to letter OK, They sent a
4:06
preservation letter to Twitter for the stepfather's account,
4:11
and then they followed up with a search warrant.
4:13
So let's take a little time out here and discuss what law
4:17
enforcement did right here and why those printed emails were or
4:21
not sufficient emails. Can we always?
4:25
We know emails can easily be faked.
4:28
Yep, they can. You can go.
4:29
On and easily edit an e-mail too.
4:32
Once you've received it, you can edit it, yes.
4:34
Headers are most likely not present in printed emails,
4:38
right? I mean, you have to dig a little
4:40
deeper to get to those e-mail headers.
4:42
But so Becky, what if all of those printouts had the e-mail
4:47
headers included in that? Would you be happy with those
4:50
paper printouts? Lots of emails.
4:52
Absolutely not. And if the.
4:54
Support is your client. No, I mean seriously, we want
4:58
actual evidence every time so that we can find the facts.
5:03
We need to be able to authenticate and validate and
5:06
dig a little deeper and time stamp.
5:09
If if we take paper one time, then they're just going to.
5:14
Just keep. Trying to give you paper to to
5:16
look at and be digital evidence artifacts, right?
5:20
And you know, with AI, everybody's talking about it and
5:24
it's getting a lot better about about what it can generate.
5:28
So it could generate, in theory, a really authentic looking
5:32
e-mail that's just going to look fantastic once it's printed out.
5:36
That's exactly right. And paper is not proof when the
5:39
original item was digital. Yeah.
5:42
And we've said it before I think on the podcast, but even today
5:45
we continue to get paper printouts as part of discovery
5:50
that's coming to us, the digital forensic examiners.
5:53
And it used to be a digital thing.
5:55
It used to be a file. And here they are printing it
5:58
out and handing it over to us to, to do a forensic
6:01
examination. That's.
6:03
Crazy. All right, let's get back to the
6:04
case. What were the results that came
6:07
back from Twitter? So this is interesting because
6:10
the production from Twitter reveals that there are no
6:15
messages in the stepfather's account that matches those Gmail
6:21
emails that were printed out. It was really kind of a sort of
6:26
moment for the state. Wait, so there was.
6:28
None. None, none.
6:30
All Twitter could do was verify that the username in those
6:34
printouts matched the stepfather's account, his name,
6:38
the e-mail address, all that stuff checked out.
6:40
Now there were some DM in his Twitter account, but nothing
6:45
that matched anything in those emails at all.
6:48
So this sounds good for the defense attorney's client for
6:52
the subject. But let's play devil's advocate,
6:55
or I guess in this case, we'll pay play the role of the state.
6:59
Why doesn't Twitter have any of these messages?
7:02
They never existed. Could be or maybe they were
7:05
deleted. Maybe the search warrant didn't
7:08
ask for the right thing. Maybe it only said active
7:11
messages or? Maybe the search warrant asked
7:14
for notifications of the DMS and being sent out like those, those
7:19
e-mail alerts that were being sent out rather than the DMS,
7:21
Yeah. And so they were deleted so long
7:24
ago, even Twitter doesn't have a record of the messages and or
7:28
notifications any longer. Much like when you delete emails
7:34
and it purges from the network. If they're not saved off
7:38
someplace else, then they're just not available anymore.
7:41
But so say he deleted the fact that he sent them, is there
7:46
anything else you can do to sort of mitigate that fact?
7:49
Like what else do you do then? You could certainly asked to see
7:54
if you could get another search warrant to Twitter to produce
7:57
the messages of the stepdaughter.
7:59
Yeah, great. See.
8:00
What she has in her inbox for her DMS on her Twitter account.
8:05
Yeah, cuz it goes back and forth.
8:06
There's, there's 2 ends to this conversation.
8:09
And if it's in one platform, then you should be able to get
8:13
the artifacts, the preservation, the data from one of the
8:18
accounts. Yeah.
8:19
So couple of things to be learned from this conversation.
8:23
If you wrote the search warrant, go back and reread it and make
8:26
sure you ask for the right things.
8:28
And then secondly, you know, look at the other accounts
8:31
involves, can you send a search warrant to them?
8:33
Right, exactly. So getting back to the case, we
8:35
have printed emails and basically nothing from Twitter
8:39
at this point. So in the name of due diligence
8:42
and investigation, one O 1 law enforcement does get a search
8:47
warrant to seize and examine the subjects electronic devices
8:52
which include his PlayStation, his laptop, iPad and his phone.
8:59
So, Stacey, what are the results of the newly seized digital
9:02
evidence items? It's not much better and nothing
9:05
corroborates the narrative from the stepdaughter.
9:08
Nothing matches up with those printed emails that were
9:11
produced, and all along the way the subject has been very
9:15
adamant that he has never used Twitter for any sort of
9:19
messaging like that, and he certainly does not send DMS to
9:23
his stepdaughter. So with those results, the
9:26
defense files a motion to exclude those printed emails,
9:29
and then the state provides about 300 pages of more printed
9:35
emails as supplemental. Discovery 300 pages.
9:40
Where in the world did those come from?
9:42
So they had the stepdaughter log into her Gmail account at the
9:47
DA's office and just hit print on all of them.
9:51
So now we are 300 pages instead of 60 pages.
9:56
Are these different from the 1st 60 pages?
9:59
Or why are there more pages now? Some were the same, but some
10:04
were new and the new ones were pretty incriminating.
10:07
Like. What?
10:08
So there were somewhere it was like make a video doing certain
10:12
things and then it gave detailed instructions of what to do.
10:16
DM's asking if you're horny, asking if she's up, and just
10:20
various other messages in the middle of the night.
10:22
So we are way more explicit than the initial emoji stuff.
10:28
Absolutely. But here's where it starts to
10:31
get interesting. I said these emails were going
10:33
to be interesting. So when the defense attorney,
10:36
Lauren, compared the original 60 pages to the new 300 pages, she
10:42
found what she thought first appeared to be duplicates, which
10:45
is what you would expect, right? But turns out they were
10:49
different. Like how?
10:50
How were they different? So those emoji emails that were
10:53
originally produced, Same date, same content, but different time
10:58
stamps. And sometimes the time stamps
11:00
were only off by two or three minutes from each other.
11:04
That shouldn't happen, right? I mean if they're just different
11:08
printouts of the same. E-mail, right?
11:10
Your time shouldn't be changing on your emails when you print
11:13
them out. And so that's what made Lauren
11:17
suspend. But you know, as forensic
11:19
examiners, sometimes we do see emails that have two different
11:24
time stamps. So what time stamps are we
11:26
seeing as forensic examiners, Becky, when we're seeing two
11:29
different time stamps on one e-mail?
11:31
So with our forensic tools, we're going to see both the sent
11:34
and received mess time stamp messages.
11:38
And normally they're, they only differ by seconds, but I mean,
11:42
I've seen a couple of minutes, you know, a time where it was a
11:45
couple of minutes in the past. Yeah.
11:47
And Becky, when we start, you know, as examiners, we're going
11:51
to review the e-mail headers and we're likely going to see a lot
11:55
more time stamps within those e-mail headers as well.
11:58
Absolutely. When it comes to a user printing
12:01
an e-mail, it's generally just going to show the one time stamp
12:06
and it's normally the received time stamp.
12:08
I mean, I wish we could see these emails.
12:11
You had a forensic examiner look at any of the data for the
12:15
defense to help them analyze the contents of these emails to
12:19
inform their motion to exclude all these printouts of emails.
12:23
Not from what I could tell based on the podcast discussion.
12:27
Now, their motion to exclude the emails was based on
12:32
authentication issues. Now these these are lawyers
12:35
talking about it, so they might use some different terminology
12:38
than what we might say as forensic examiners.
12:41
But when they're talking about authentication issues, what
12:44
they're saying is there's no way to verify that these messages
12:51
actually came from her stepfather via Twitter.
12:55
So basically they're saying hearsay and there's no
13:00
cooperation from Twitter's certified records.
13:04
And so Twitter would be the actual source of those DMS.
13:09
But I think it's amazing that the lawyer caught the
13:12
differences between these all these printed emails in the 1st
13:14
place, right? Absolutely.
13:16
So what did the defense discuss regarding Gmail's ability to
13:21
authenticate these Twitter messages?
13:24
You basically hit it right now. Third Point was that Gmail can
13:27
only authenticate that an e-mail exists in someone's account.
13:32
It can't authenticate that a Twitter message ever actually
13:37
happened on the Twitter platform.
13:39
Right. And let's not forget, some
13:42
deeper digging needs to be done on those emails, even if they
13:47
are the the Gmail account of a user, to confirm that they
13:52
actually came from Twitter in the first place.
13:55
Why? Whatever do you mean?
13:57
Becky Well, like so. e-mail spoofing is a common technique
14:02
used by attackers to make an e-mail appear as though it came
14:06
from a trusted sender, even though it did not.
14:09
Because e-mail was originally built on trust rather than
14:13
authentication, the sender's display name and from address
14:17
can be easily forwarded. While a spoofed message may look
14:21
legitimate to the recipient, the truth is revealed in the full
14:26
e-mail headers, which showed the actual path the message took
14:31
through mail servers and whether authentication checks passed or
14:37
failed. Reviewing e-mail headers allows
14:40
investigators to determine where an e-mail truly originated,
14:43
identify red flags like domain mismatches or authentication
14:48
failures, and distinguish between an external spoofing
14:53
attempt and a compromised internal account.
14:57
In digital forensics and incident response, headers are
15:00
critical because they provide objective, technical evidence
15:05
that helps establish how an e-mail was sent, assess the
15:10
scope of an incident, and support accurate investigation,
15:14
investigative and legal concerns.
15:16
Yeah. So you mentioned attacker.
15:17
So in in this case, it's not necessarily an attacker, but it
15:21
could be somebody up to no good wanting to essentially frame
15:27
somebody, make it look like somebody else did something
15:31
that's right. And so you can certainly do a
15:34
lot of the same things that those.
15:36
Attackers do, right? Absolutely.
15:39
Make it look, try to make it look like it's coming from
15:42
somewhere else. Try to make it look like it's
15:44
coming from Twitter. Yep, Yep.
15:46
And you can go in there and edit your DMS.
15:50
Maybe she had DMS from other people and then she just went in
15:55
there and and changed the content of the message body,
15:58
right, Because when you get those DMS, I'm assuming is I
16:03
haven't, I don't, I don't tweet. So I, I don't know.
16:06
Do you tweet, Becky? I don't.
16:08
I don't. We say everything we got to say
16:11
on this podcast, right? But I did some kind of looking
16:14
around for some today's, you know, DMS and see what they look
16:19
like. And for the most part, it kind
16:20
of looks like what I would expect of those sort of things,
16:23
that everything is always coming from the same e-mail address
16:27
from Twitter. And then in the body of it, it's
16:30
saying like who it's from and giving that short preview.
16:33
So you could certainly edit the body of a message after you've
16:36
received it and saved it. I mean, you can edit an e-mail
16:41
if you if you compromise an e-mail account or you session
16:44
hijack, you can you can edit an e-mail.
16:47
Yeah, yeah. So there's all sorts of things
16:49
that could have happened. And that's why it would have
16:51
been great if a forensic examiner had gotten their
16:56
eyeballs on actual emails, not the printouts, the emails to see
17:00
what was in there and what was going on.
17:02
Could they account for those two or three minutes?
17:06
Why were they different? Because obviously two or three
17:08
minutes, it's not like a time zone situation.
17:11
Exactly. All right, so let's get back to
17:12
the case. The state ends up asking for
17:15
continuance, and then within five days they've got the
17:19
certified records directly from Gmail via a search warrant.
17:23
And those records matched which version?
17:27
300 page print out the second one that they produced.
17:30
And did they ever go back to Twitter and try?
17:32
Again, Nope. The state never tried a
17:35
different search warrant or tried to get the stepdaughter's
17:38
account from anything that they discussed on the podcast.
17:42
Yeah, so that seems like a gap. What about this time stamp
17:45
issue? How did the state explain that?
17:47
Well, the state calls in their computer expert and he was
17:51
called in at one of the hearings that happened before the actual
17:54
trial. And this is a gentleman from the
17:56
Attorney General's office, and the defense lawyer was familiar
17:59
with him because they had been in some trials together before.
18:02
And what was his explanation it? Was simply that sometimes
18:06
computers make mistakes. My, that's the exclamation
18:11
explanation. I'm just stuttering because.
18:17
That's what she said on on the podcast.
18:20
Wow, and how did that go? Well, the defense used it
18:23
against them. Basically, that's the defense's
18:28
job, right? Anything you say, we can and
18:30
we'll use it against you. And basically they're saying,
18:34
look, if computers make mistakes, then you can't rely on
18:38
any computer generation narrated evidence, right?
18:41
Fairpoint. So did the judge exclude the
18:43
emails? Nope.
18:45
The motion was denied. The judge did say he was very
18:48
close to excluding them, but he gave the state a chance to go
18:52
back and fix those authentication issues.
18:55
OK, so were there any other sources that the state tried to
18:58
use? They tried to bring in some sort
19:00
of message board that the stepdaughter had created on
19:04
Discord, and this was created around the same time she was
19:07
preparing to tell her mom, and it had screenshots of the same
19:10
emails of some of them. I don't know if it was all of
19:13
them, but at least some of them. But ultimately the judge
19:16
excluded it because he said this was something she created and
19:20
not authentic evidence. OK.
19:23
So at trial, how did the emails actually come in to the court
19:29
and who testified? Yeah.
19:31
So they come in through the stepdaughters testimony and
19:34
basically the prosecution walked up, handed her a stack of
19:37
documents and said, do you recognize these?
19:40
Oh my gosh, And she said. She said yes.
19:43
And then they go through that whole rigmarole.
19:46
Rigmarole, you know, what are they?
19:48
They're emails I received. And what specifically are those
19:51
emails through messages from him?
19:53
And they do that whole rigmarole to get them all brought in, as
19:56
you do when you're bringing in evidence.
19:58
And did the defense object. Yeah, they did some objections
20:02
along the way, but ultimately all the emails came in.
20:05
Wow, which version? All three.
20:07
Yeah, when when I said all three, I meant all three.
20:09
So the original 60 printed pages from that were brought into the
20:12
police station originally. Then the 300 pages that were
20:16
printed in the DDA's office. And it sounds like the Gmail
20:21
certified records that came back from the search warrant were
20:24
brought in as well. But it kind of sounded like
20:26
those were maybe brought in through one of the the
20:29
detectives instead of the daughter.
20:30
But so basically there's three versions of those emails
20:33
floating around that came in during the trial.
20:35
Oh my. Gosh, how did the prosecution
20:36
use them during? Trial, Yeah.
20:38
They basically used them as a crutch.
20:40
So, you know, it was something to refresh her memory.
20:43
They'd say. They'd show her the e-mail and
20:45
ask, On this date, did you get a message from your stepfather?
20:48
And she'd say yes. They'd ask what does this mean?
20:52
And she'd explain it and say like, oh, it meant to like, go
20:56
have sex in the garage. OK, So what was the defense's
21:01
strategy on cross? They really didn't harp on the
21:05
e-mail themselves during the cross, OK.
21:08
Really. And why not?
21:09
Instead they chose to just focus on her stepdaughters online life
21:14
and the fact that she did a lot of storytelling and character
21:17
creation. And their strategy basically was
21:20
to show that she lives online, creates fiction and has an
21:24
active imagination rather than trying to, you know, attack all
21:29
three versions of emails that have been brought in.
21:31
OK, So what was Lauren's theory about how these emails came to
21:34
be? So she said she could never make
21:36
any sense of it. Whether it was the stepdaughter
21:39
that created them or something else happened, she didn't know.
21:43
A forensic examiner really could have helped determine the facts
21:48
of exactly where these emails were coming from.
21:50
In this case, what struck Lauren the lawyer as strange about
21:55
these emails? So from her point of view, it
21:57
really was the timing because the most damning stuff came in
22:01
at the 11th hour. Remember, those 300 printed
22:04
pages had much more descriptive actions that were that she was
22:09
supposedly being directed to take from her stepfather via
22:13
those late night 3:00 AM DMS. And so, you know, her thinking
22:17
was, if you're making an allegation, wouldn't you just
22:22
give over the most damning evidence first?
22:24
Yeah, that's odd. Now when stuff comes in at at
22:28
the 11th hour, it is hard to counter that.
22:32
And that's why sometimes we're up late nights working cases
22:36
because we've got a court deadline to meet.
22:39
But it's even harder if you don't even have an expert
22:43
already involved in this. What?
22:45
Were there any other inconsistencies?
22:48
Well, I mean, the big one is, you know, the emails in in the
22:51
line with either the stepfathers or the stepdaughters phone
22:55
dumps. We didn't really talk about the
22:58
stepdaughters, but they also did an extraction of her phone as
23:02
well. So they've got her phone dumped.
23:04
And so in general, we would have expected to see those emails
23:08
that she received to be present on her phone.
23:12
But instead, all the state produced was just standalone
23:15
emails with no corroboration from any of the devices or the
23:20
actual platforms such as Twitter that they were coming from, or
23:24
even Gmail. But again, let's stop and
23:26
consider why are we not seeing this evidence on their phones?
23:31
Well, first, you wouldn't expect to see emails on the
23:33
stepfather's phone stating that he sent Adm from.
23:37
Twitter, right? But you would expect to see his
23:41
DMS in his Twitter account if Twitter was on his phone.
23:46
Yeah, you would expect to see those same emails on the
23:49
stepdaughters phone if the e-mail account is being synced
23:52
to her phone. Unless.
23:55
Well, I was going to say, unless we we talked about that with a
23:58
couple episodes ago, unless that sync date is shorter than how
24:02
old those emails are. That's exactly right.
24:04
And apps have to be installed. Yep, can't get nothing if
24:08
there's if there's no app. So if nobody has Twitter.
24:10
So I, I mean, like, did neither of them have Twitter then,
24:14
right? For none of these tweets or
24:17
excuse me, DMS to be present on their phones?
24:20
If she's actively using Gmail, that's not on her phone either.
24:24
I mean, if, you know, people tend to send notifications to
24:29
the e-mail accounts that they use, right?
24:30
That's right, data could be gone if it's deleted.
24:33
Yeah. But if it's deleted, are there
24:36
going to be any hints left behind?
24:38
Yeah, yeah. Missing row numbers.
24:40
Yeah, so say he has Twitter, there's there's going to be some
24:44
missing row numbers if he was going through and and deleting
24:48
all of those DMS. Absolutely.
24:50
All right, So let's get back to the case.
24:51
How did the defense handle this? In closing, basically?
24:56
They highlighted that these are computer generated messages
25:02
purported to be sent by Twitter. And they say that, you know,
25:06
there's nothing to authenticate that there was ever actually any
25:11
Twitter direct messages to begin with.
25:14
And they reiterated Gmail can't authenticate that Twitter sent a
25:19
message on their platform and they don't have any of those
25:22
messages from Twitter. So they don't have the source of
25:26
those messages. Yeah, that's good information to
25:28
share with the jury. Next up was the states closing
25:32
and they put up a PowerPoint with the worst emails.
25:35
Are you horny? Make a video, send me a picture
25:38
and use those as proof of the exploitation charge.
25:44
Did Lauren think those emails would be enough to convict an
25:47
exploitation? Yeah.
25:49
It it sounds like she was really worried about it and she thought
25:52
that the emails alone were going to be enough to prove the
25:56
electronic communication for the enticement and all of the
26:01
sexually explicit activity as well.
26:04
So what happened? Did the jury convict on
26:06
exploitation or any of the other charges?
26:09
Nope, it was not not guilty on all counts.
26:13
Really. Even with the printed emails.
26:17
Yeah, Lauren happened to talk to the jury foreman after the
26:21
verdict, and he said that the emails were so confusing about
26:26
where they came from and what they were, and ultimately the
26:30
jury wasn't satisfied that they actually came from the
26:33
stepfather. Yeah, they never proved that.
26:36
That is, you know, the responsibility of the state is
26:39
to prove that that happened. And they they weren't able to
26:42
prove that. So even through the judge, even
26:45
though the judge let them in and the emails seemed damning, the
26:50
jury applied reasonable doubt. Yeah.
26:54
You know, ultimately the confusion on these emails led to
26:58
an acquittal on everything, including, you know, that
27:00
serious charge of the Child Exploitation.
27:03
Wow, that's fascinating. The authentication issues that
27:06
the defense raised pre trial seem to be exactly what the jury
27:11
was hung up on. Yeah, the judge let them in, but
27:15
the jury did their job and said we're not convinced these
27:18
actually came from this guy. And so that's why it's so
27:22
important as a forensic examiner to be able to get the jury to
27:25
understand what you're talking about in the 1st place and then
27:29
go a step further and explain why it matters.
27:33
Now, if a forensic examiner had been brought in from the by the
27:37
defense, maybe the judge would have tossed those emails and
27:40
never even let him in in the first place.
27:42
Yeah, Yeah. Absolutely.
27:44
This is a perfect example of how evidence issues can make or
27:49
break a case even when things get admitted into.
27:53
Trial, absolutely. And it's also a great reminder,
27:57
or maybe a learning opportunity for both the prosecution and the
28:01
defense to never accept a paper print out of an e-mail or any
28:07
other digital evidence. That's exactly right.
28:10
Well, thank you for that, this printed emails episode.
28:15
It's been very interesting. Until next time, stay safe, stay
28:18
sharp, and keep parsing the truth one bite at a time.
28:23
If you enjoyed this episode, make sure to follow us to get
28:26
notified the next time a new episode drops.
28:29
If you can do more, head on over to parsingthetruth.com and
28:34
donate by clicking on the donate button.
28:36
Parsing the Truth is a nonprofit organization and we are raising
28:40
money to send a new digital Forensic Examiner to IASYS
28:43
training next year in Orlando. Thanks.
28:53
OK, so what's going? On.