What You Need to Know About a Debtor's Leased Computers

Every lessor and bankruptcy professional understands that the Chapter 7 trustee has the duty to investigate the financial affairs of the debtor and to ensure that books and records are properly turned over in accordance with Section 704. The debtor has the obligation, under Section 521(4), to “surrender to the trustee all property of the estate and any recorded information, including books, documents, records, and papers relating to property of the estate, whether or not immunity is granted under Section 344 of this title.” Likewise, Chapter 11 and Chapter 13 trustees and debtors have similar duties and responsibilities.

Setting and Consequences

Millions of individuals and businesses use leasing for financing the purchases of computers, personal digital assistants, digital devices, and have e-mail, word processing, spreadsheets, and accounting software applications used to record and report on personal and business financial activities.

Bankruptcy statistics are devoid of information regarding the number of individuals and business debtors using leased computers at the time of the bankruptcy filing. Most lessors are all too aware of having the debtor/trustees rejecting lease contracts and the resulting losses involved. Many times a lessor fails to promptly “pick-up” the property (computers) after the lease has been rejected. You have always owned these computers, but do you now own what is on those used computers? This author is not an attorney and is not providing legal advice. Ask your attorney and be sure to make your attorney aware of what is actually on those used computers you have just taken back. If you do not know exactly what is on your computers' hard disk drives, including servers, perhaps you need to discuss that with your attorney.

Be careful what you sell if you are not the owner of the software and the e-data present on the hard disk drives, especially if you know or should have known that confidential information resides on the hard disk drive. Let us make this easy for every lessor. Every hard disk drive probably has some confidential and personal information on it even if it cannot be seen. Possibly those who want to buy these used computers from you have ulterior motives. Did I forget to ask, what is your risk in selling these computers if child pornography was discovered on those hard disk drives later? That would be another good question to ask your attorney.

Resolution

As a lessor, you need legal advice when dealing with issues related and pertaining to the sale and/or re-leasing of computers to others taken back after the rejection of the lease in bankruptcy.

Possibly the trustee will want to hold on to those computers until a digital forensic accounting technologist has examined them for the existence of the debtors' books and records. It may be better to wait for the return of this property until after the trustee has finished with them. Consider having your attorney make arrangements with the trustee to have the hard disk drives “wiped clean” after the digital forensic accounting technologist has finished examining the computers and before return to you.

If you find that potential buyers for these used computers with “cleaned” hard disk drives have weaned, and there is now little or no interest in these used computers, you just figured out why they wanted them in the first place.

Unfortunately, for the lessor of computers in a bankruptcy case, most trustees do not have the understanding and technical expertise necessary to properly investigate digital technology in the modern financial world and you may be delayed in the return of your property.

Time Isn't on the Lessor's Side

Fact: Since time is all-important, the trustee should obtain access to all computer hard disk drives (HDD), handheld PC/personal digital assistants (PDA) and digital devices, including but not limited to CD, DVD, Microdrive, CompactFlash, SmartMedia, SecureDigital, Memory Stick and MultiMediaCard even before the Section 341 examination.

Fact: Hesitation on the part of the debtor and/or insiders to allow that examination may be considered an indication that necessary digital financial information is in jeopardy so long as controlled by the debtor and insiders and that the trustee will have to take further action. This will make it more difficult to secure return of the leased computers.

Fact: The lessor should always assist the trustee in obtaining the digital books and records contained on computers and digital devices.

Exactly Why is the Trustee Holding on to These Leased Computers?

Fact: Trustees need to promptly examine the debtor's e-data to find where the money went and possibly, who may have the money or property now.

Fact: A proper digital examination includes but is not limited to a review of the computerized accounting records, e-mail messages, instant messages, electronic memos, word processing documents, databases, spreadsheets, archives, presentations, graphics, and address books or other contact management data contained in the wide assortment of computers, digital devices or PDA used by the debtor.

How Will the Forensic Technologist Acquire the E-data?

Fact: The first step in maintaining the best practices for protecting the integrity and validity of the debtor's digital information is for the forensic technologist to create what is called a forensic image (sometimes technically referred to as low-level bit-stream image) from the debtor's computer HDD, PDA, and digital devices.

Fact: The forensic images will permit the trustee to assess the debtor's activities with a greater degree of completeness and this, in turn, allows the trustee to promptly ascertain the location of any hidden property for the benefit of creditors.

Why Can't the Trustee Just Use the Office Staff or Accountants?

Fact: Starting up or just turning on or off the computers, PDA and digital devices may jeopardize the evidence.

Fact: Try as they may, the trustee or others should never use the debtor's leased computers and attempt to copy its computer files and then somehow hope to find the trail of money or property. These actions will only succeed in compromising the integrity of the digital forensic evidence in the debtor's e-data.

Why Does the Digital Forensic Image Need to be Created?

Fact: Before the trustee can begin to do an investigation of the debtor's financial information and the books and records, the trustee needs to have a digital forensic image created of the computer HDD, PDA and digital storage sources that are exact forensic image copies that will be admissible as evidence in court.

Fact: The forensic technologist will match (bit by bit) the e-data present on the debtor's original source HDD, PDA and digital devices with the forensic image being created during the acquisition process. The process will provide a digital signature that is unique and cannot be replicated, except when the algorithm is applied to the same identical e-data, just like a fingerprint.

Fact: The “trail of evidence” must be proven unbroken from the debtor's digital data sources to the witness stand.

What Would Happen if the Trustee Fails to Obtain the Forensic Image Copies?

Fact: The real cost to the creditors would be enormous if the trustee fails to obtain the forensic image copies, and instead allows the debtor's computers, PDA and digital devices to be accessed by someone who lacks forensic technologist expertise. The debtor, insiders and others in an Adversary Proceeding might allege that the information obtained by the trustee from the debtor's computer HDD was unsubstantiated and could not be corroborated.

Are the Debtor or Insiders Hiding E-Data from the Trustee and Creditors?

Fact: Invisible attachments. Valuable financial information in the form of e-data can be hiding behind legitimate files on the debtor's leased computer HDD as invisible attachments. The Microsoft NTFS file system provides for Alternative Data Streams (also referred to as Multiple Data Streams) and ADS allows for the hiding of the debtor's e-data such as books and records, documents, files, folders and programs. The trustee must find the second set of books. This important information is not visible, unless one knows how to find it. The trustee should not allow this to be overlooked during the examination of the e-data.

Fact: Steganography or covered writing and encrypted e-data. An investigation is made to locate encrypted information. Once these encrypted files are identified it will be necessary to decrypt those files. A steganalysis, the inspection of digital files to detect steganography, is performed for the discovery of hidden embedded information inasmuch as steganography poses a significant threat to the recovery of money for the creditors.

Fact: Most often encrypted and hidden information will likely provide confidential evidence that the debtor or insiders are concealing. This evidence may provide extensive e-clues that could expose fraudulent accounting activities and point to fraudulent conveyances that can be recovered for the creditors.

Fact: Recovery of deleted information. Most participants in the bankruptcy process are not aware, even after numerous and repeated scandals, that when you typically delete e-data, the computer only marks this information as deleted in the (computer) file system.

Fact: Previously deleted e-data is extremely delicate from an evidentiary standpoint. Allowing the use (other than by the forensic technologist) of the debtor's computer HDD, PDA and digital devices during the investigation of a case will overwrite information on those devices. This will jeopardize discovery that could benefit the creditors.

Fact: In many cases, it is likely that e-data files have been deleted. The forensic technologist will search the discovered and recovered deleted files and documents for specific excerpts of text using GREP regular expressions (derived from UNIX) and this enables powerful text searches using special characters. In addition, logical expressions (Boolean) allow for searching using two or more search strings in a variety of ways and use lightning-fast multiple simultaneous text searches of the debtor's e-mail messages, documents, and files.

Fact: This information may provide the trustee with the evidence necessary to recover assets for the benefit of the creditors before the money is all gone.

What Are the Economic Benefits for the Creditors in Doing This?

Fact: Finding the following is an example of how the digital forensic accounting technologist can benefit the creditors:

• Find hidden assets, including the ability to trace individual transactions from start to finish.
• Identify and reveal digital evidence related or pertaining to possible claims against Board of Directors for breach of fiduciary duty, fraud, theft, conversion and unjust enrichment.
• Detect and uncover unusual transactions, including money and property transfers and complex related-party activities.
• Identify and reveal digital evidence related or pertaining to possible claims against Preferred Shareholders for breach of contract and fraud.
• Expose facts and circumstances relating to issues of substance over form that could not otherwise be documented.
• Uncover fraudulent accounting activities.
• Discover undisclosed business or business activities to which assets may have been shifted.
• Detect hidden documents, including the ability to trace related activities.
• Identify and expose digital evidence related or pertaining to possible claims against auditors for breach of contract, breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, fraud and negligent misrepresentation, professional negligence, and securities fraud.
• Discover and expose digital evidence related or pertaining to possible claims against underwriters for breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, claims of breach of contract, fraud and negligent misrepresentation, and securities fraud.
• Detect the backdating of vital documents leading to possible fraudulent conveyance actions.
• Reveal abuses, concealment and destruction of computers and e-data leading to '707(a), 707(b) and '727 referrals by the trustee.

Summary

Computers, digital devices, e-mail and the Internet have utterly changed how businesses operate today. However, creditors, including the lessor of computers do have a solution for recovery in the digital e-age.

The trustees and creditors needs the skills of the digital forensic accounting technologist, experienced in bankruptcy, litigation, financial and accounting matters. These experts, knowledgeable with computerized financial and accounting applications and especially effective in the analysis of complex financial information, provide maximum results for the ultimate benefit of the creditors.

Dealing with the technical aspects of a case, the creditors need to be sure that the digital forensic accounting specialist follows established digital forensic methodologies. Please contact the author directly to receive a nonexhaustive list of best practices for the acquisition of digital forensic accounting evidence within the bankruptcy context for the uttermost recovery for creditors.

Every lessor and bankruptcy professional understands that the Chapter 7 trustee has the duty to investigate the financial affairs of the debtor and to ensure that books and records are properly turned over in accordance with Section 704. The debtor has the obligation, under Section 521(4), to “surrender to the trustee all property of the estate and any recorded information, including books, documents, records, and papers relating to property of the estate, whether or not immunity is granted under Section 344 of this title.” Likewise, Chapter 11 and Chapter 13 trustees and debtors have similar duties and responsibilities.

Setting and Consequences

Millions of individuals and businesses use leasing for financing the purchases of computers, personal digital assistants, digital devices, and have e-mail, word processing, spreadsheets, and accounting software applications used to record and report on personal and business financial activities.

Bankruptcy statistics are devoid of information regarding the number of individuals and business debtors using leased computers at the time of the bankruptcy filing. Most lessors are all too aware of having the debtor/trustees rejecting lease contracts and the resulting losses involved. Many times a lessor fails to promptly “pick-up” the property (computers) after the lease has been rejected. You have always owned these computers, but do you now own what is on those used computers? This author is not an attorney and is not providing legal advice. Ask your attorney and be sure to make your attorney aware of what is actually on those used computers you have just taken back. If you do not know exactly what is on your computers' hard disk drives, including servers, perhaps you need to discuss that with your attorney.

Be careful what you sell if you are not the owner of the software and the e-data present on the hard disk drives, especially if you know or should have known that confidential information resides on the hard disk drive. Let us make this easy for every lessor. Every hard disk drive probably has some confidential and personal information on it even if it cannot be seen. Possibly those who want to buy these used computers from you have ulterior motives. Did I forget to ask, what is your risk in selling these computers if child pornography was discovered on those hard disk drives later? That would be another good question to ask your attorney.

Resolution

As a lessor, you need legal advice when dealing with issues related and pertaining to the sale and/or re-leasing of computers to others taken back after the rejection of the lease in bankruptcy.

Possibly the trustee will want to hold on to those computers until a digital forensic accounting technologist has examined them for the existence of the debtors' books and records. It may be better to wait for the return of this property until after the trustee has finished with them. Consider having your attorney make arrangements with the trustee to have the hard disk drives “wiped clean” after the digital forensic accounting technologist has finished examining the computers and before return to you.

If you find that potential buyers for these used computers with “cleaned” hard disk drives have weaned, and there is now little or no interest in these used computers, you just figured out why they wanted them in the first place.

Unfortunately, for the lessor of computers in a bankruptcy case, most trustees do not have the understanding and technical expertise necessary to properly investigate digital technology in the modern financial world and you may be delayed in the return of your property.

Time Isn't on the Lessor's Side

Fact: Since time is all-important, the trustee should obtain access to all computer hard disk drives (HDD), handheld PC/personal digital assistants (PDA) and digital devices, including but not limited to CD, DVD, Microdrive, CompactFlash, SmartMedia, SecureDigital, Memory Stick and MultiMediaCard even before the Section 341 examination.

Fact: Hesitation on the part of the debtor and/or insiders to allow that examination may be considered an indication that necessary digital financial information is in jeopardy so long as controlled by the debtor and insiders and that the trustee will have to take further action. This will make it more difficult to secure return of the leased computers.

Fact: The lessor should always assist the trustee in obtaining the digital books and records contained on computers and digital devices.

Exactly Why is the Trustee Holding on to These Leased Computers?

Fact: Trustees need to promptly examine the debtor's e-data to find where the money went and possibly, who may have the money or property now.

Fact: A proper digital examination includes but is not limited to a review of the computerized accounting records, e-mail messages, instant messages, electronic memos, word processing documents, databases, spreadsheets, archives, presentations, graphics, and address books or other contact management data contained in the wide assortment of computers, digital devices or PDA used by the debtor.

How Will the Forensic Technologist Acquire the E-data?

Fact: The first step in maintaining the best practices for protecting the integrity and validity of the debtor's digital information is for the forensic technologist to create what is called a forensic image (sometimes technically referred to as low-level bit-stream image) from the debtor's computer HDD, PDA, and digital devices.

Fact: The forensic images will permit the trustee to assess the debtor's activities with a greater degree of completeness and this, in turn, allows the trustee to promptly ascertain the location of any hidden property for the benefit of creditors.

Why Can't the Trustee Just Use the Office Staff or Accountants?

Fact: Starting up or just turning on or off the computers, PDA and digital devices may jeopardize the evidence.

Fact: Try as they may, the trustee or others should never use the debtor's leased computers and attempt to copy its computer files and then somehow hope to find the trail of money or property. These actions will only succeed in compromising the integrity of the digital forensic evidence in the debtor's e-data.

Why Does the Digital Forensic Image Need to be Created?

Fact: Before the trustee can begin to do an investigation of the debtor's financial information and the books and records, the trustee needs to have a digital forensic image created of the computer HDD, PDA and digital storage sources that are exact forensic image copies that will be admissible as evidence in court.

Fact: The forensic technologist will match (bit by bit) the e-data present on the debtor's original source HDD, PDA and digital devices with the forensic image being created during the acquisition process. The process will provide a digital signature that is unique and cannot be replicated, except when the algorithm is applied to the same identical e-data, just like a fingerprint.

Fact: The “trail of evidence” must be proven unbroken from the debtor's digital data sources to the witness stand.

What Would Happen if the Trustee Fails to Obtain the Forensic Image Copies?

Fact: The real cost to the creditors would be enormous if the trustee fails to obtain the forensic image copies, and instead allows the debtor's computers, PDA and digital devices to be accessed by someone who lacks forensic technologist expertise. The debtor, insiders and others in an Adversary Proceeding might allege that the information obtained by the trustee from the debtor's computer HDD was unsubstantiated and could not be corroborated.

Are the Debtor or Insiders Hiding E-Data from the Trustee and Creditors?

Fact: Invisible attachments. Valuable financial information in the form of e-data can be hiding behind legitimate files on the debtor's leased computer HDD as invisible attachments. The Microsoft NTFS file system provides for Alternative Data Streams (also referred to as Multiple Data Streams) and ADS allows for the hiding of the debtor's e-data such as books and records, documents, files, folders and programs. The trustee must find the second set of books. This important information is not visible, unless one knows how to find it. The trustee should not allow this to be overlooked during the examination of the e-data.

Fact: Steganography or covered writing and encrypted e-data. An investigation is made to locate encrypted information. Once these encrypted files are identified it will be necessary to decrypt those files. A steganalysis, the inspection of digital files to detect steganography, is performed for the discovery of hidden embedded information inasmuch as steganography poses a significant threat to the recovery of money for the creditors.

Fact: Most often encrypted and hidden information will likely provide confidential evidence that the debtor or insiders are concealing. This evidence may provide extensive e-clues that could expose fraudulent accounting activities and point to fraudulent conveyances that can be recovered for the creditors.

Fact: Recovery of deleted information. Most participants in the bankruptcy process are not aware, even after numerous and repeated scandals, that when you typically delete e-data, the computer only marks this information as deleted in the (computer) file system.

Fact: Previously deleted e-data is extremely delicate from an evidentiary standpoint. Allowing the use (other than by the forensic technologist) of the debtor's computer HDD, PDA and digital devices during the investigation of a case will overwrite information on those devices. This will jeopardize discovery that could benefit the creditors.

Fact: In many cases, it is likely that e-data files have been deleted. The forensic technologist will search the discovered and recovered deleted files and documents for specific excerpts of text using GREP regular expressions (derived from UNIX) and this enables powerful text searches using special characters. In addition, logical expressions (Boolean) allow for searching using two or more search strings in a variety of ways and use lightning-fast multiple simultaneous text searches of the debtor's e-mail messages, documents, and files.

Fact: This information may provide the trustee with the evidence necessary to recover assets for the benefit of the creditors before the money is all gone.

What Are the Economic Benefits for the Creditors in Doing This?

Fact: Finding the following is an example of how the digital forensic accounting technologist can benefit the creditors:

• Find hidden assets, including the ability to trace individual transactions from start to finish.
• Identify and reveal digital evidence related or pertaining to possible claims against Board of Directors for breach of fiduciary duty, fraud, theft, conversion and unjust enrichment.
• Detect and uncover unusual transactions, including money and property transfers and complex related-party activities.
• Identify and reveal digital evidence related or pertaining to possible claims against Preferred Shareholders for breach of contract and fraud.
• Expose facts and circumstances relating to issues of substance over form that could not otherwise be documented.
• Uncover fraudulent accounting activities.
• Discover undisclosed business or business activities to which assets may have been shifted.
• Detect hidden documents, including the ability to trace related activities.
• Identify and expose digital evidence related or pertaining to possible claims against auditors for breach of contract, breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, fraud and negligent misrepresentation, professional negligence, and securities fraud.
• Discover and expose digital evidence related or pertaining to possible claims against underwriters for breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, claims of breach of contract, fraud and negligent misrepresentation, and securities fraud.
• Detect the backdating of vital documents leading to possible fraudulent conveyance actions.
• Reveal abuses, concealment and destruction of computers and e-data leading to '707(a), 707(b) and '727 referrals by the trustee.

Summary

Computers, digital devices, e-mail and the Internet have utterly changed how businesses operate today. However, creditors, including the lessor of computers do have a solution for recovery in the digital e-age.

The trustees and creditors needs the skills of the digital forensic accounting technologist, experienced in bankruptcy, litigation, financial and accounting matters. These experts, knowledgeable with computerized financial and accounting applications and especially effective in the analysis of complex financial information, provide maximum results for the ultimate benefit of the creditors.

Dealing with the technical aspects of a case, the creditors need to be sure that the digital forensic accounting specialist follows established digital forensic methodologies. Please contact the author directly to receive a nonexhaustive list of best practices for the acquisition of digital forensic accounting evidence within the bankruptcy context for the uttermost recovery for creditors.