CHEVRON CORP. AND TEXACO PETROLEUM CO. v. THE REPUBLIC OF ECUADOR
THIRD EXPERT REPORT OF J. CHRISTOPHER RACICH March 16, 2015
!
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER TABLE OF CONTENTS I.!
PREVIOUS*REPORTS*...............................................................................................................*1!
II.!
MATERIALS*CONSIDERED*.....................................................................................................*1!
III.!
SUMMARY*OF*CONCLUSIONS*...............................................................................................*1!
IV.!
ANALYSIS*....................................................................................................................................*4! A.!
Additional*analysis*of*Mr.*Guerra’s*hard*drive*further*calls*into*question* the*veracity*of*his*testimony*......................................................................................................*4! (i)! Mr.!Guerra’s!reinstall!of!his!operating!system!in!July!2010!is!a!common!tactic! to!destroy!old!files!and!emails!..............................................................................................................!4! (ii)! Mr.!Guerra’s!Internet!history!contained!a!limited!number!of!snapshots!of!his! Hotmail!email!inbox!..................................................................................................................................!4! B.! Further*analysis*of*Mr.*Zambrano’s*hard*drives*provides*additional* evidence*in*support*of*the*conclusion*that*he*and*his*assistant*drafted*the* Judgment*...........................................................................................................................................*5! (i)! There!is!evidence!that!Internet!history!that!was!formerly!recorded!on!Mr.! Zambrano’s!computer!has!since!been!lost!to!normal!computer!usage!and!the! passage!of!time!............................................................................................................................................!5! (ii)! The!Microsoft!OSessions!logs!on!Mr.!Zambrano’s!hard!drives!show!that!the! users!of!those!two!computers!consistently!used!Microsoft!Word!over!the! entire!time!period!during!which!the!Lago!Agrio!Judgment!was!being!drafted!..............!6! (iii)! SATJE!logs!show!that!the!Judgment!was!uploaded!from!Mr.!Zambrano’s! computer!.......................................................................................................................................................!7!
V.!
REBUTTAL*OF*THIRD*LYNCH*REPORT*.............................................................................*7! A.!
Mr.*Lynch*points*to*no*evidence*demonstrating*that*Mr.*Zambrano*did*not* author*the*Judgment*.....................................................................................................................*7! (i)! Mr.!Lynch!fails!to!provide!any!proof!that!anyone!other!than!Mr.!Zambrano! authored!Providencias.doc!and!thus!the!Lago!Agrio!Judgment!..............................................!7! (ii)! That!certain!allegedly!unfiled!documents!were!not!found!on!the!Zambrano! hard!drives!is!immaterial;!Mr.!Lynch’s!reliance!on!this!fact!is!not!a!reflection! of!computer!forensics!expertise!..........................................................................................................!8! (iii)! Mr.!Lynch!presents!no!evidence!that!text!could!have!been!copied!into!the! Judgment!from!sources!written!by!anyone!other!than!Mr.!Zambrano!...............................!9! (iv)! The!fact!that!there!is!“no!complete!and!standalone!version”!of!the!Judgment! on!the!Zambrano!hard!drives!is!unsurprising!...............................................................................!9! (v)! Mr.!Lynch!overstates!the!conclusion!to!be!drawn!from!the!documented! Microsoft!Excel!usage!between!December!21,!2010!and!December!28,!2010!............!10! (vi)! Mr.!Lynch’s!conclusions!regarding!the!speed!of!data!entry!are!consistent! with!the!Judgment!being!drafted!on!Mr.!Zambrano’s!computers!......................................!10! B.! The*serial*numbers*of*the*forensic*images*of*USB*devices*actually* reviewed*by*Mr.*Lynch*have*never*been*identified*..........................................................*11! C.! The*copying*and*deletion*of*data*on*September*26,*2012*is*consistent*with* the*setXup*of*a*new*user*profile,*not*a*deliberate*attempt*to*destroy*data*..............*12!
VI.!
CONCLUSIONS*.........................................................................................................................*13! -i-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER I.
PREVIOUS REPORTS
1. This report supplements my reports of December 16, 2013 and November 7, 2014, in which I reviewed and commented on the reports submitted by Mr. Lynch and the forensic images of devices used by Mr. Guerra and Mr. Zambrano addressed therein.1 II.
MATERIALS CONSIDERED
2. In preparation for rendering this report, in addition to the materials I reviewed for my December 16, 2013 and November 7, 2014 reports, I reviewed and analyzed the following materials:
III.
(a)
The Expert Report of Spencer Lynch, dated January 14, 2015, in the abovecaptioned case (the “Third Lynch Report”) and all its exhibits; and
(b)
A file entitled “All SATJE Logs for 2003-0002.xlsx,” which I have been informed are the logs extracted from the SATJE System based on a search for the Lago Agrio Litigation case number (2003-0002) and which Winston & Strawn LLP provided to me.
SUMMARY OF CONCLUSIONS
3. I have reviewed the Third Lynch Report, which disagrees with certain conclusions I made based upon the forensic evidence provided. The chief point of disagreement is whether the forensic evidence supports the conclusion that Mr. Zambrano authored the Lago Agrio Judgment. In my opinion, it does. 4. Mr. Lynch’s review of both the Guerra and Zambrano computers appears to proceed from the predetermined conclusion that Mr. Guerra and the Lago Agrio Plaintiffs ghostwrote various “providencias” (court orders) and the Lago Agrio Judgment for Mr. Zambrano. The only way I can reconcile Mr. Lynch’s conclusions with the forensic evidence is to recognize that that predetermined conclusion has dictated Mr. Lynch’s interpretation of the evidence and not the other way around. My review began with the forensic evidence, which leads to the conclusions I have described previously and explain below. 5. My conclusions fall into two broad categories, those related to analysis of Mr. Guerra’s hard drives and those related to examination of Mr. Zambrano’s hard drives. In this regard, I note that Mr. Lynch has never responded to my original report2 addressing Mr. Guerra’s hard drives. In that report I concluded: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1 My December 16, 2013 report described my education, experience, compensation arrangement and other background information. That information remains the same, except that I have testified seven more times since then. A current Curriculum Vitae is attached hereto as Exhibit 1. 2
Racich Expert Rpt. (Dec. 16, 2013). -1-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER (a)
The forensic evidence does not support Guerra’s claim that he created, authored, or edited any of the eleven alleged draft orders issued by Mr. Zambrano in the Lago Agrio Litigation that were found on his (Guerra’s) computer.
(b)
All of the alleged draft Lago Agrio orders on Guerra’s computer were put there on July 23, 2010. Therefore, according to Mr. Lynch’s analysis,3 these documents were copied to Guerra’s computer after Mr. Zambrano issued them.
(c)
There is no forensic evidence showing that Guerra created or authored any of the 105 alleged draft orders in non-Lago Agrio cases that were found on his computer; all 105 documents were created on computers other than Guerra’s.
(d)
No chain of custody documentation was provided for the Guerra computer covering the two days between when Guerra gave it to Chevron’s investigators and when the investigators gave it to Mr. Lynch’s technical staff.
(e)
During the two-day gap between Guerra and Mr. Lynch’s staff, the vast majority of the files on Guerra’s computer were accessed — including all of the files relevant to this investigation. There is no way to know what was done to those files or their metadata during this time period.
6. These conclusions regarding Mr. Guerra’s computer stand unrebutted and call into serious question Mr. Lynch’s or Claimants’ conclusions based on this forensic evidence. 7. Since I filed my prior report I have further analyzed the Guerra computer and come to the following additional conclusions: (a)
On July 23, 2010, Mr. Guerra reinstalled the Windows operating system on his computer and then copied a large number of files onto his computer. Reinstalling the operating system and copying large numbers of files is a common technique used by novice computer users to destroy forensic evidence. It is not 100% effective but makes recovery of forensic evidence predating the reinstall very difficult.
(b)
I was able to recover some fragments of Mr. Guerra’s Hotmail email inbox using the Internet history from his computer. I have provided those fragments as Exhibit 2. However, we are not able to read the contents of these messages using Mr. Guerra’s Internet history.
8. Second, in my first report analyzing the Zambrano computers I concluded that the forensic evidence supports the conclusion that the Lago Agrio Judgment was written on Mr. Zambrano’s computers. In my opinion the forensic evidence is more consistent with this conclusion than with a third party writing the Judgment and giving it to Mr. Zambrano !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 3 First Lynch Rpt. at 13. -2-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER immediately before he issued it on February 14, 2011.4 Most importantly, in my prior report I offered the following conclusions based on the forensic evidence: (a)
The document that later became the Lago Agrio Judgment was created on Mr. Zambrano’s computer on October 11, 2010, and was saved on average multiple times per day (at least 439 times) between then and March 4, 2011.
(b)
The drafts of the document that later became the Lago Agrio Judgment contain increasing amounts of text. All of these versions have metadata consistent with the file being authored and edited on Mr. Zambrano’s computers.
(c)
There is no evidence that any version or portion of the Lago Agrio Judgment was provided to Mr. Zambrano by any third party.
(d)
The Zambrano hard drives contain evidence showing that legal research and translation websites were accessed between October 11, 2010 and March 4, 2011. A significant amount of further Internet history reflecting other Internet usage is not recoverable.
(e)
Mr. Zambrano’s computers were connected over a network such that a user on the New Computer could access files on the Old Computer without necessarily realizing that the files were still physically saved on the Old Computer. The forensic evidence demonstrates that this in fact happened at least forty times.
9. In my professional opinion all of this evidence is more consistent with Mr. Zambrano and his assistant writing the Judgment than it is with a third party writing the Judgment and giving it to Mr. Zambrano immediately before he issued it on February 14, 2011. 10. Since I filed my prior report I have further analyzed the Zambrano computers and come to the following additional conclusions: (a)
A definite but unknown volume of Internet history was formerly recorded on Mr. Zambrano’s computer but has likely been lost to normal computer usage and the passage of time.
(b)
The Microsoft OSessions logs on Mr. Zambrano’s hard drives show that the users of those two computers consistently used Microsoft Word over the entire time period during which the Lago Agrio Judgment was being drafted.
(c)
The SATJE logs provided to me show that the Judgment was uploaded from Zambrano’s computer using his username shortly after the Judgment was officially printed.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 4 Racich Expert Rpt. (Nov. 7, 2014). -3-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER IV.
ANALYSIS A.
Additional analysis of Mr. Guerra’s hard drive further calls into question the veracity of his testimony
(i)
Mr. Guerra’s reinstall of his operating system in July 2010 is a common tactic to destroy old files and emails
11. Mr. Lynch and I agree that on July 23, 2010 the Windows operating system was reinstalled on Mr. Guerra’s computer. Reinstallation of Windows can be used as a crude technique to attempt to overwrite data. When Windows is reinstalled there are two events that cause significant file loss and limit the ability of forensic analysis to recover old files and data. First, all files are stored on a computer similarly to as in a library. In a library, the books are stored on shelves and a card catalog is maintained that allows a user to quickly find a particular book. A computer stores files in much the same way but with a file index that points to files. When the operating system is reinstalled on a computer the old file index is destroyed and a new one is created that does not know about the files that were there before. While some of the old files still remain after the operating system is reinstalled and can be found by searching manually, they can no longer be accessed directly. 12. Second, when Windows is reinstalled a large number of files are created on the hard drive, this will, overwrite data and files that existed on the hard drive prior to the reinstallation. These files created on or copied to the new operating system are replacing files from the former operating system. 13. For these reasons, reinstalling the operating system is a tactic used by computer users to overwrite files and emails. Unlike Mr. Lynch’s allegations about Mr. Zambrano’s alleged data destruction by copying a small volume of files, Mr. Guerra’s reinstall of his operating system would likely have permanently deleted many files. As Stroz Friedberg found in another high profile case, “[t]he reinstallation of an operating system is a destructive action that may have the effect of overwriting existing data on a hard drive. In Stroz Friedberg’s experience with electronic forgery cases, the reinstallation of an operating system can be done in an effort to destroy or conceal data.”5 (ii)
Mr. Guerra’s Internet history contained a limited number of snapshots of his Hotmail email inbox
14. I have been informed that Mr. Guerra used Hotmail for his email. The primary way that most people access Hotmail is through an Internet browser like Internet Explorer. As a result, whenever a user accesses his or her Hotmail inbox through a browser, that access is recorded in the user’s Internet history. Accordingly, I analyzed Mr. Guerra’s Internet history to determine whether any of Mr. Guerra’s email activity could be reconstructed. While not all of !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 5 Stroz Friedberg Report of Digital Forensic Analysis, Ceglia v. Zuckerberg, et al., Case No: 1:10-cv-00569-RJA (Dkt. 325) (W.D.N.Y. Mar. 26, 2012) at 46. -4-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER Mr. Guerra’s Internet history can be recovered, I was able to reconstruct certain information regarding his Hotmail account. In addition to snapshots of Mr. Guerra’s inbox, I was able to recover information about some individual email messages. Throughout the most relevant time periods, October 2010–March 2011 and 2012, there are numerous email fragments indicating messages were received, the content of which is now not recoverable. For example, from January 17, 2011 until February 1, 2011, there appear to be at least five emails (and as many as forty) that were received but have since been deleted;6 or from October 27, 2010 until November 7, 2010 there appear to be at least ten emails and as many as twenty-six that were received but have since been deleted.7 15. I was unable to identify evidence of any emails from or to anyone identified as a member of the Lago Agrio Plaintiffs’ team. B.
Further analysis of Mr. Zambrano’s computers provides additional evidence in support of the conclusion that he and his assistant drafted the Judgment
(i)
There is evidence that Internet history that was formerly recorded on Mr. Zambrano’s computers has since been lost to normal computer usage and the passage of time
16. My analysis of the Internet history of the Zambrano hard drives supports two conclusions: (1) a user of those computers accessed translation and legal research websites; and (2) the recoverable Internet history is necessarily incomplete, likely due to the passage of time. Mr. Lynch does not dispute either conclusion 17. What Mr. Lynch does say about the Internet history is immaterial. The fact that there is not more evidence of particular sites in the recoverable history is likely a consequence of the inherent limitation of the limited history available years after the fact. And the fact that a particular number of history records (Mr. Lynch says 50,000) between October 2010 and March 2011 were recovered does not tell us what percentage of the once total that number represents. 18. My conclusion that the recovered history is necessarily incomplete is itself based on the evidence — notably the “hit counts” of particular websites. As I have explained previously, a “hit” is recorded each time a website is visited. When a person visits a website there are often many Internet history records made as each page causes the web browser to download a multitude of supporting files (images, video, script files, etc). The recovered history reveals gaps in recorded hit counts. For example, the web address! http://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1283878539&rver=6.0.528 5.0&wp=MBI&wreply=http:%2F%2Fsn121w.snt121.mail.live.com%2Fdefault.aspx&lc =3082&id=64855&mkt=es-es !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 6 Exhibit 2, Records 271-311. 7
Exhibit 2, Records 197-203. -5-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER shows a hit count of 14 in the history entry dated 1/7/2011. Yet on the next recovered history entry, dated 1/13/2011, the hit count had jumped to 29. This demonstrates that at least fifteen history entries are no longer recoverable. And that is just for one website. Other examples are attached as Exhibit 3. ! (ii) The Microsoft OSessions logs on Mr. Zambrano’s hard drives show that the users of those two computers consistently used Microsoft Word over the entire time period during which the Lago Agrio Judgment was being drafted 19. Mr. Lynch infers, based on the Microsoft OSessions logs, that Microsoft Word was not in use on Mr. Zambrano’s computers long enough for him to have written the Lago Agrio Judgment. As a brief reminder, Microsoft OSessions logs are event logs that track certain information about the use of Microsoft Office products. Mr. Lynch previously stated that Microsoft OSessions logs could be used to identify the amount of time that Microsoft Office products were open, but he provided no support for that conclusion. He later (with the Third Lynch Report) provided a testing document purporting to support his conclusion. 20. While that document purports to support Mr. Lynch’s conclusions about the amount of time Microsoft Office products were opened on the Zambrano Computers, this does not explain how the logs function (or fail to function) in many cases, nor does it preclude any other scenarios whereby Microsoft Word could have been in use for a greater amount of time than the logs indicate. For example, time using Word was not recorded in Mr. Lynch’s testing when Microsoft Word crashed, when the power went out, or when Microsoft Word froze.8 Thus, Mr. Lynch’s own testing results show that there are multiple scenarios whereby Word could have been in use for more hours than is recorded. 21. I also disagree with Mr. Lynch’s conclusion that the forensic evidence demonstrates that Microsoft Word was open for an insufficient amount of time within which to draft the Lago Agrio Judgment. In fact I have not seen a computer forensic expert previously offer an opinion, using the science of computer forensics, as to how fast a person can draft a document. This is not a question of computer forensics. Even a layperson understands that people draft documents differently from one another; some rely extensively on handwritten drafts and notes, while others do not. 22. What is a question of computer forensics, however, is the total length of time Microsoft Word was open and when it was open. Mr. Lynch does not assess the latter except for the December 21–28, 2010 time period. I have analyzed the entire time period between October 1, 2010 and March 4, 2011 and found that Microsoft Word was in near constant use. 23. Had the Lago Agrio Plaintiffs or Mr. Guerra provided Mr. Zambrano with a copy of the Judgment immediately before it was to be issued, Microsoft Word would reflect !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 8 Third Lynch Report at 40. -6-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER unreasonably long periods of use in that short timeframe. The Zambrano hard drives reflect no such intense last-minute use of Word. (iii)
SATJE logs show that the Judgment was uploaded from Mr. Zambrano’s computer
24. Counsel for the Republic of Ecuador provided me with all logs from the SATJE system for the Lago Agrio case. I understand that these logs were received from the National Judicial Counsel in response to counsel’s request for all SATJE log entries for case 2003-0002. These logs are attached as Exhibit 4.9 25. Based upon what appears to be typical logging information, the SATJE logs provided to me show that the Final Judgment was uploaded to the SATJE system on February 14, 2011 at 9:15am by someone using Mr. Zambrano’s username and computer. While I have not had access to the SATJE system itself, review of the logging information found in Exhibit 4 shows that on 2011-02-14 (the date convention of the log), a document with the “Providencia Name” Sentencia was uploaded by someone logged in as zambranon. A field for this entry titled “Providencia,” moreover, appears to contain text related to the Judgment. 26. Mr. Lynch claims, based on logs provided to him by Claimants’ counsel, that there is no evidence that the Judgment was uploaded to SATJE from either of Mr. Zambrano’s computers.10 Mr. Lynch says that he “understand[s] that the request for which the SATJE Logs were provided was for the logs for the two computers assigned to Mr. Zambrano.”11 It appears that his logs are incomplete which led him to his erroneous conclusion. V.
REBUTTAL OF THIRD LYNCH REPORT A.
Mr. Lynch points to no evidence demonstrating that Mr. Zambrano did not author the Judgment
(i)
Mr. Lynch fails to provide any proof that anyone other than Mr. Zambrano authored Providencias.doc and thus the Lago Agrio Judgment
27. Mr. Lynch acknowledges that the evidence shows that drafted iterations of the Lago Agrio Judgment existed on Mr. Zambrano’s computers between October 2010 and February 2011. However, Mr. Lynch raises the possibility that a portion of the Judgment was authored on some other computer and then transferred to Zambrano’s computers via one or more USB devices. But the evidence supports only the first possibility, as I have discussed extensively. Mr. Lynch provides no evidence of the second possibility, nor have I found any. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 9 Like Mr. Lynch, I have provided all columns that contain data. 10
Third Lynch Rpt. at 33.
11
Third Lynch Rpt. at 33. -7-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER 28. Mr. Lynch describes ways in which he could support his theory that a copy of the Lago Agrio judgment was transferred to the Zambrano Computers, including gaining access to the actual USB devices that were attached to Mr. Zambrano’s computers. But no supporting evidence has actually been provided. The only theory that is consistent with the available evidence is that the Judgment was drafted over time on Mr. Zambrano’s computers. Mr. Lynch’s alternative theory appears to be based not on evidence, but on Mr. Guerra’s testimony.12 (ii)
That certain allegedly unfiled documents were not found on the Zambrano computers is immaterial; Mr. Lynch’s reliance on this fact is not a reflection of computer forensics expertise
29. Mr. Lynch infers that the absence of certain allegedly unfiled work product13 from the Zambrano hard drives!indicates that Mr. Zambrano did not author the Lago Agrio Judgment, and that my decision not to address this is telling. Neither is accurate. 30. It is my understanding that portions of the Judgment appear to contain text identical to documents Claimants assert were the unfiled work product of the Lago Agrio Plaintiffs. It is also my understanding that the Republic of Ecuador contends that these documents were filed with the Lago Agrio Court. Mr. Lynch concludes that because these allegedly unfiled documents do not appear on the Zambrano computers that Mr. Zambrano did not author the Judgment.14 31. I have been informed that documents in the Lago Agrio Litigation were generally not filed electronically, so I am unaware of any authorship conclusions to be drawn from the absence of these documents on the Zambrano hard drives. Instead, the fact that the documents are not present electronically indicates only that Mr. Zambrano did not have electronic copies of the documents. I see no reason why Mr. Zambrano could not have copied these portions of the Judgment from filed, paper copies of these documents. 32. But again, this point is not based on computer forensics, so I did not address it. My role is to assess the evidence presented and to come to conclusions based on that evidence. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 12 Lacking any evidence, Mr. Lynch speculates that files with generic names (such as “KKKK.doc”) accessed from USB devices on Mr. Zambrano’s computers could have transferred the Judgment. But these generic files are all outside the time period when Guerra claims the Lago Agrio Plaintiffs gave Zambrano the Judgment. Moreover, these documents appear to come from Zambrano’s assistant, Evelyn Calva. 13
Because neither Mr. Lynch’s analysis nor mine addresses whether any particular documents comprise part of the Lago Agrio Record, it is inappropriate for Mr. Lynch to conclude, and adopt nomenclature, e.g., “Plagiarized Documents,” suggesting that certain documents were not filed, and thus were “plagiarized” in the Judgment by an author other than Mr. Zambrano. To the extent I refer to these documents, I do so as “allegedly unfiled work product.” 14
Third Lynch Rpt. at 6. -8-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER In this case neither Mr. Lynch nor I found electronic copies of the allegedly unfiled work product on the Zambrano computers. The only conclusion I can draw is that it is unlikely that either party gave Mr. Zambrano electronic copies of these documents. (iii)
Mr. Lynch presents no evidence that text could have been copied into the Judgment from sources written by anyone other than Mr. Zambrano
33. Mr. Lynch and I agree that it is possible that text was copied from another document on Mr. Zambrano’s computers and pasted into the draft of the Judgment.15 The forensic evidence cannot tell us definitively, and it certainly cannot tell us that text was copied from a document not on Mr. Zambrano’s computers or any other document he did not author. 34. Consequently, Mr. Lynch appears to assume that the possibility of copying and pasting indicates that someone other than Mr. Zambrano authored the Judgment. At the very least, Mr. Lynch ignores the possibility that if Judgment text were copied from one document on Mr. Zambrano’s computers to another, then Mr. Zambrano could have authored both documents. There is certainly no evidence suggesting otherwise. 35. In his original report on the Zambrano hard drives, Mr. Lynch identifies multiple files with some variation on the name “CASO TEXACO.doc,” at least two of which no longer exist. As he says, we do not know the contents of these files.16 We do know that Mr. Zambrano’s computer had a file with the same name. These two files or any number of other files no longer recoverable are therefore just as, if not more, likely sources for the copied text than external files from third-party authors which no longer exist. (iv)
The fact that there is “no complete and standalone version” of the Judgment on the Zambrano hard drives is unsurprising
36. Mr. Lynch attempts to make a point about the fact that no file exists that (1) contains only the final Judgment and (2) was last saved on February 14, 2011.17 But Mr. Lynch ignores all of the evidence and facts that are counter to his conclusion. 37. To come to his conclusion, Mr. Lynch first assumes that Mr. Zambrano would have created a backup copy of the Judgment on the day that he issued it.18 While I agree that making a backup of an important file is a best practice, I also have extensive experience with the fact that people routinely do not back up any of their files, let alone their most important ones.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 15 Third Lynch Rpt. at 22. 16
Second Lynch Rpt. at 34.
17
Third Lynch Rpt. at 31.
18
Third Lynch Rpt. at 31-32. -9-
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER 38. The fact that no backup of the Judgment dated February 14, 2011 can be found on the Zambrano hard drives shows that Mr. Zambrano may not have followed best practices to protect his work. In my experience this is not evidence of ghostwriting. 39. Mr. Lynch then points to the fact that the header in the final Judgment file on the Zambrano hard drives is different from the version of the Judgment that was issued. But again, this is not evidence of ghostwriting. Instead this is evidence of the steps Mr. Zambrano took in printing the final Judgment. Mr. Zambrano presumably saved the Judgment thinking he would submit it at 8:33 in the morning. For some reason unknown to both experts, Judge Zambrano actually printed it four minutes later and updated the printed header accordingly but did not resave the file. Again, while this may not be best practice, it is not evidence of ghostwriting. (v)
Mr. Lynch overstates the conclusion to be drawn from the documented Microsoft Excel usage between December 21, 2010 and December 28, 2010
40. Mr. Lynch states that between December 21, 2010 and December 28, 2010 “text and statistics from the Unfiled Selva Viva Data Compilation, a series of Excel spreadsheets, were added to the [draft Judgment.]”19 Mr. Lynch grounds his opinion in his conclusion that Microsoft Excel was used to calculate the statistics using the allegedly unfiled Selva Viva Database.20 Because he identifies no Microsoft Excel usage on the Zambrano computers during the timeframe between the two iterations of Providencias.docx where those statistics were added, he concludes that Judge Zambrano could not have authored the Judgment. This overly broad conclusion does not have forensic merit. 41. On this evidence, it cannot be said either that the allegedly unfiled Selva Viva Database is the source of statistics in the Judgment or that Mr. Zambrano did not simply copy these statistics from a former judge’s notes. There may be still other explanations. All we can say is that the computer forensic evidence we have at present cannot answer the question. (vi)
Mr. Lynch’s conclusions regarding the speed of data entry are consistent with the Judgment being drafted on Mr. Zambrano’s computers
42. Mr. Lynch states that based upon his analysis, and assuming an eight-hour work day, text was added to Providencias.docx at a rate of 17.5 pages per day between October 10, 2010 and February 14, 2011. To begin with, whether or not this interim conclusion is accurate does not change the validity of the ultimate conclusion that the drafting—regardless of pace— occurred on Mr. Zambrano’s computers. Moreover, during this same timeframe, the forensic evidence demonstrates that other documents from which text could have been copied and pasted, including Caso Texaco.doc, were also opened and edited.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 19 Third Lynch Rpt. at 10. 20
Third Lynch Rpt. at 10. - 10 -
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER 43. Any further conclusion (including whether 17.5 pages per day is reasonable in context) again reaches beyond the evidence itself. Notably, Mr. Lynch appears to ignore other testimony that cuts against his conclusion. For example, Mr. Zambrano testified that he worked extensively from handwritten notes—the composition and organization of which would not be reflected in his computers’ Microsoft Word data. The forensic evidence imperfectly captures the time during which the Judgment was typed but does not capture, imperfectly or otherwise, the time Mr. Zambrano spent researching and writing on paper. B.
The serial numbers of the forensic images of USB devices actually reviewed by Mr. Lynch have never been identified
44. Mr. Lynch appears to have misunderstood my statements in my pervious report with regards to the Serial Numbers of the images of USB Devices provided in this case. I was not referring to the evidence found in the registries of both Mr. Guerra’s computer and Mr. Zambrano’s computers that indicated that multiple USB Devices had been attached to both computers (although not during the relevant time frame of October 11, 2009 to February 28, 2010). 45. Beginning on Page 14 of the Second Lynch Report, Mr. Lynch posited conclusions based upon analysis of USB Device images that were provided to both him and me, and implied that these images were in fact somehow related to the USB Devices that were attached to both computers. 46. However, to associate USB device images with records of a USB device being shared between two computers, two pieces of information are needed. First, one needs the Serial Number of the USB device as it is recorded when the image of that device is taken. Second, one needs the Windows Registry entries and log files from both computers indicating that a particular USB device was attached. These logs record the Instance ID of the USB device that is attached. Mr. Lynch and I agree on this point. 47. Mr. Lynch uses the USB device Instance IDs recorded in the log files and the Windows Registry of the two computers to identify that two USB devices were attached to both the Zambrano and Guerra Computers. However, Mr. Lynch could not take the next required step to connect those Instance IDs with any of the USB device images because he did not provide any record of the Serial Numbers of the USB Devices that associates them with the Instance IDs of the five forensic images. This information is not found within the images of the USB devices themselves, and at present, no chains of custody or log files identifying the Serial Numbers of the USB device images that Mr. Lynch refers to on Page 14 of the Second Lynch Report have ever been provided. 48. Without these Serial Numbers and Instance IDs it would be difficult, if not impossible, to link the forensic images that Mr. Lynch and I have in our possession to the USB devices that were attached to the Guerra and Zambrano Computers. 49. Mr. Lynch has now provided Serial Numbers and Instance IDs for these USB devices — his prior reports did not include all necessary information as he intimates. But Mr. - 11 -
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER Lynch has still provided no documentation, e.g., a chain of custody, showing where these numbers came from. As I said in my first report, this information should have been included with the images that were taken. As it stands there is nothing to tie these numbers to the actual Serial Numbers that Claimants produced. C.
The copying and deletion of data on September 26, 2012 is consistent with the set-up of a new user profile, not a deliberate attempt to destroy data
50. Mr. Lynch calls my conclusion “implausible” that the copying of a large set of files into a folder named Respaldo (“backup” in English) and the subsequent deletion of those files was part of normal computer maintenance.21 But as Mr. Lynch admits, he does not in fact know the motivation of the person copying 734 MB of data to the Old Computer on September 26, 2012, nor do I. However, based upon how computers work, the forensic evidence, and certain reasonable inferences, we can conclude that the purpose of the copying of data was not to deliberately overwrite data. 51. While Mr. Lynch discounts the fact that only 734 MB of data was copied from one location on the computer to a backup folder, this is a key point in determining if the copying and deletion was a deliberate attempt to overwrite data. The amount of data is important because it comprised only 4% of the free space on the computer. Therefore, if the intent of the user was to try to destroy data, this action was unlikely to overwrite any particular data and definitely would not guarantee that any particular data was overwritten. In my opinion it is very difficult to ascribe intent to overwrite deleted files to an action that was sorely inadequate for that task. 52. Mr. Lynch also states that I do not discuss the subsequent deletion of this limited amount of data following its creation, and that this subsequent deletion is a strong indicator that the user was attempting to overwrite data, as opposed to just making a copy of (and subsequently deleting) that data. Mr. Lynch fails to explain what leads him to his conclusion, as it is not the deletion of the data that overwrote the small amount of Unallocated Space, but rather the copying itself that did so. There are many possibilities that might have motivated a person to create, fill, and then delete a folder. The copy may have been a temporary backup while some data was moved to a different hard drive or a server, and afterwards, the user decided that the data was unnecessary on the computer. The copy may have been a mistake and once the user realized, they decided to rectify their mistake. The motivation of the user cannot be ascertained using computer forensics. 53. Again, while neither Mr. Lynch nor I can say with certainty what was the motivation of the user copying the data, we do know that (1) a folder names “RESPALDO PC PENTIUM 4” was created on September 26, 2012, (2) this folder contained approximately 734 MB of user created data, (3) the files copied only wrote data to approximately 4% of Unallocated Space, leaving 96% of Unallocated Space undisturbed, (4) the person who copied this data had no way of directing the computer to overwrite specific data, and (5) while the folder with the !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 21 Third Lynch Report at 34. - 12 -
CONFIDENTIAL: NOT TO BE PUBLICLY DISCLOSED SUBJECT TO CONFIDENTIALITY ORDER data was subsequently deleted, this deletion did not in any way affect what data was potentially overwritten in unallocated space due to the original copying. VI.
CONCLUSIONS
54. There is no computer forensic evidence provided that shows that Mr. Guerra or the Lago Agrio Plaintiffs authored either the multiple providencias found on Mr. Guerra’s computer, or the Judgment. 55. The reinstallation of Windows on the Guerra Computer in July 2010 overwrote data that existed in unallocated space of the Guerra Computer. 56. The Hotmail data that was recovered from Mr. Guerra’s computer does not indicate that any emails were sent or received between this Hotmail account and the Lago Agrio Plaintiffs. 57. A definite but unknown volume of Internet history was formerly recorded on Mr. Zambrano’s computer but has likely been lost to normal computer usage and the passage of time. 58. The Microsoft OSessions logs on Mr. Zambrano’s hard drives show that the users of those two computers consistently used Microsoft Word over the entire time period during which the Lago Agrio Judgment was being drafted. 59. The SATJE logs provided to me indicate that the Judgment was uploaded from Zambrano’s computer using his username shortly after the Judgment was officially printed. 60. These facts are all consistent with the premise that the Judgment was written on the Zambrano Computers. 61. I reserve the right to supplement my report or opinions should additional information become known to me.
_____________________________ J. Christopher Racich President, Vestigant, LLC
- 13 -