Legal Technology News - E-Discovery and Compliance Blog

« Keys to Planning Effective Document Review | Main | “Computer gobblydegook is not confusing or prejudicial.” »

April 12, 2009

"We're Both Part of the Same Hypocrisy, Senator"

Gf6 Every film fan knows the scene in The Godfather where three sons, brash heir-apparent Sonny,  law-abiding war hero Michael and level-headed lawyer Tom Hagen, plot to avenge an attempt on their father’s life.  As Sonny and Tom quarrel, Michael realizes that only he can get close enough to eliminate those responsible.

Sonny chides Michael: “What do you think this is like the Army where you can shoot 'em from a mile away?  No you gotta get up like this and, badda-bing, you blow their brains all over your nice Ivy League suit.  You're taking this very personal.”

Michael placidly counters, “It's not personal, Sonny. It's strictly business. 


It’s the turning point for Michael Corleone—a point of no return, really—and a classic quote defining the line between conscientious commerce and vindictiveness.


Guidance Software, inc. and AccessData Corp. have been arch competitors for years, but lately their rivalry has taken a particularly ugly turn-- one that doesn’t seem strictly business.  They’ve gone to the mattresses, and it feels very personal.


Maybe it started getting nasty when AccessData announced its intent to mount a hostile takeover of Guidance Software after shares of Guidance dropped over 80%.  Guidance’s board pooh-poohed the overture, and some have suggested that AccessData didn’t have the capital to follow through.  Was former Guidance V.P. and now AccesssData CEO, Tim Leehealey, just yanking Guidance’s chain?  He promised to carry the fight to shareholders but, as a shareholder stuck with a bunch of comatose shares, I can assure you AccessData hasn’t offered me any graceful exit.  ;-)


Then there were those reports of severe security flaws in AccessData’s FTK product that AccessData claimed were being trumped up and spread by Guidance Software.  When the claim turned up as a comment to an earlier post on this blog, AccessData asked us to pull the post offline.  Site editor Monica Bay and I demurred, figuring that open dialog would be preferable to censorship.


Then there was the embarrassing flap arising from Guidance Software’s inability to produce documents in a case where it was being sued for sexual discrimination by former employee, Cassondra Todd.  The Associated Press reported some very pointed salvos by Leehealey launched against Guidance, including an e-mail where Leehealey, Todd’s former manager while at Guidance, reportedly questioned whether someone at Guidance was “setting Todd up to be fired.”


Last week, Guidance Software asked me to expose a “fraudulent” AccessData press release crowing about how a court “validated” its software as a blatant rip off (the word “plagiarized” was bandied about) of a Guidance press release claiming that the same court validated Guidance Software's’s Encase product in the same opinion.  Was this a court of law or Good Housekeeping?  Indeed, the April 1 AccessData release so closely mirrors the Guidance release that it would be easy to assume it’s just a an ill-conceived April Fool’s joke, except that the release has lasted long after a joke would have run its course, and apparently it's been picked up as news.


Since both companies have importuned me to expose the other’s infamia--“Just when I thought I was out, they pull me back in”--I figure I’m entitled to share my two cents about the whole sordid escapade. 


What the truth?  In my mind, both companies are full of it when they claim that the Court “validated” their products in Smith v. Slifer Smith & Frampton/Vail Assocs. Real Estate, LLC, 2009 WL 482603 (D. Colo. Feb. 25, 2009).  FTK wasn’t even close to being vetted by the court in this setting and EnCase was just a tool used by one of the testifying experts.  Moreover, Guidance has been miscasting its self-serving notions of court approvals for years, even trying to crown its Enterprise edition product with the forensic laurels earned by its Encase Forensic edition product. 


EnCase Enterprise is not “court validated.”  FTK Enterprise is not “court validated.”  And they never have been.  In competent hands, computer forensics is not a black box, pushbutton art, so the integrity of process hinges on the carpenter, not on the hammer.


Shame on AccessData and Guidance Software for how they’ve tried to spin an opinion that never considered—let alone validated—the performance or efficacy of either FTK or EnCase.  Just because a product is named in passing in a court opinion and the court doesn’t expressly label the product a steaming pile of crap does not render the product ‘court validated.’  The Smith court no more validated the merits of EnCase or FTK than the first O.J. Simpson court validated the style or comfort of Bruno Magli shoes!  The evidence came in because an expert witness shared an opinion relying in part on the use of a tool.  In fact, both products were applied to tasks so fundamentally undemanding and prosaic (e.g., GREP or "regular expression" searches) that free software downloaded from the Internet could have performed the tasks as well.


I just want to say to both companies: You sell some very fine products, and occasionally some costly clunkers.  But none of the versions you’re selling today are “court-validated” in the manner you claim.  There are new and different bugs in your products today that weren't present in any old versions once narrowly considered by courts.  So, shelve the disingenuous hype, quit acting like the cast of Mean Girls III and get down to business.  You’d best turn your full attention to product development and support lest your customers realize there are top-notch,cheaper alternatives to be had than your offerings.


So,leave the guns, and take the cannoli. 


TrackBack URL for this entry:

Listed below are links to weblogs that reference "We're Both Part of the Same Hypocrisy, Senator":


After having used both products in the past few years, both in the Government and Private Sector, I can safely say that both products work well on certain aspects of a Forensic Analysis. However, neither product is the now all, do all, be all. They have their flaws but compliment each other when used properly. What I find most disturbing is that both companies have debased their credibility by busily attacking each other in an open forum. This does not benefit either company and quite frankly I have lost a lot of respect for both companies and the personnel I know that work for them. They should be focused on improving their respective products and quit trying to kick each other in the teeth. We the customer deserve much better than what we are receiving from either company.


While as a Digital Forensic Examiner we should be proficient with our tools, I love the way that Craig sums the situation up:

“In competent hands, computer forensics is not a black box, pushbutton art, so the integrity of process hinges on the carpenter, not on the hammer.”

I could not have said it better. As an educator that instructs digital forensic classes, I’ve been dealing with students for years who allowed themselves to be brainwashed into thinking that they needed to use a specific tool in order for evidence to hold up in court.

A shameless plug for my related document - The Tools "Proven In Court" Question:

Well said Craig. As a long time infosec practitioner and 3L it's constantly frustrating to me that people don't realize that success in both cyber security and law (particularly electronic discovery) is about process and not technology. I'm a user of both of the products you mentioned and, frankly, am hoping that the latest edition of earlyCASE will find it's own place in the line-up. Credibility is about the practitioner and their process, not the ability to press the right button on the GUI. And courts validating technology? Well, I'd rather they just stick to validating the results.

So I read this case (thanks for the link Craig!) and it involves, among other issues, a specific objection to EnCase by the defense expert, who asserted that the EnCase search script employed to identify evidence of data wiping “Does not do what Penrod (the plaintiff’s expert) claims.” The Court ultimately sided with the Plaintiffs on this question, finding Penrod’s expert testimony regarding EnCase to be the most credible. Notably however, there is no evidence from the opinion of a full Daubert-type analysis (which would be true validation of the software in question) but the court clearly engages in more than a tangential reference to EnCase, devoting several paragraphs to the topic. The single FTK reference, on the other hand, is clearly a cursory mention in passing. So Guidance’s claim of validation seems to be a stretch, while AccessData’s claim is pure fiction, in my opinion.

Dear Taylor Harris:

Thanks for weighing in after a careful reading of the opinion. Your remarks caused me to go back and re-assess the court's remarks, fully prepared to backpedal if I'd gotten it wrong on first effort.

I still don't read the Court's remarks as anything remotely like a validation of EnCase, even stretching it. The Court excluded as untimely a second expert's opinion challenging the interpretations of the examiner (Penrod) using Encase. There is so much described that doesn't fit in with what I'd expect to see in a case involving mass deletion and use of file wiping tools. In fact, the more I study the opinion, the less clear it is to me that anyone involved had a coherent picture of what transpired--but I have to admit that a judge's seconhand interpretation of dueling forensic reports isn't the best way to assess any of the examiner's work.

This case seems something of a low point for computer forensics in court. I wish to heck someone would share the actual reports so we could try to make sense of the work of three examiners who can't seem to agree on much of anything.

I'd very much welcome any other computer forensic examiner posting here with their interpretation of the situation (working from the data in the opinion, of course).

One thing is still certain in my mind: this opinion is no showpiece for Guidance's or AccessData's products, and neither company should have had the cajones to posture it as a judicial validation of their products.

The comments to this entry are closed.

Sign Up for the E-Discovery and Compliance Newsletter

An Affiliate of the Network

From the Newswire

Sign up to receive Legal Blog Watch by email
View a Sample

Contact EDD Update

Subscribe to this blog's feed

RSS Feed: LTN Podcast

Monica Bay's Law Technology Now Podcasts are also available as an RSS feed.

Go to RSS Subscribe page

March 2013

Sun Mon Tue Wed Thu Fri Sat
          1 2
3 4 5 6 7 8 9
10 11 12 13 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30

Blog Directory - Blogged