27' FILED 16 FEB 23 PM 2:57 KING COUNTY SUPEFHOR COURT CLERK E-FILED CASE NUMBER: 14-2-07669-0 IN THE SUPERIOR COURT OF THE STATE OF WASHINGTON FOR THE COUNTY OF KING MOVE, INC, a Delaware corporation, REALSELECT, INC, 3 Delaware corporation, TOP PRODUCER SYSTEMS COMPANY, a British Columbia unlimited liability company, NATIONAL ASSOCIATION OF an Illinois non?profit corporation, and INFORMATION NETWORK, INC, an Illinois corporation, Plaintiffs, VS. ZILLOW, INC, a Washington corporation, ERROL SAMUELSON, an individual, and CURT BEARDSLEY, an individual, and DOES 1?20, Defendants. Case No. 14-2-07669-0 SEA DECLARATION OF BYRON LLOYD-JONES FILED UNDER SEAL PURSUANT TO COURT ORDER DATED 1. Byron Lloyd-Jones, declare as follows: I. I am employed as Director within the Digital Forensics practice in Stroz Friedberg?s London office. I have personal knowledge of the facts stated herein, and if called and sworn as a witness at trial or at any other hearing before this Court, would and could competently testify as set forth herein. I submit this declaration in support of Plaintiffs? Motion for Spoliation Sanctions. DECLARATION OF BYRON LLOYD JONES 1 23988116 ALAN 2. I have performed preservations and analyses of hundreds of digital devices, including but not limited to laptops, desktops, servers, and portable mobile devices, addressing topics such as document authenticity, access of inappropriate material, recovery of deleted ?les, and destruction of electronic evidence. I completed a (Hons) degree in Forensic Science from Nottingham Trent University in 2006, received an certi?cation in 2009, and became a Microsoft Certified Professional (MCP) in 2010. Attached as Exhibit 1 is a true and correct copy of my curriculum vitae. 3. Stroz Friedberg has been retained by Plaintiff Move, Inc. as its digital forensics expert in this case. I understand plaintiffs allege that when Defendants Errol Samuelson and Curt Beardsley resigned from Move to join Move?s largest competitor Zillow, they took Move documents, ?les, and data with them. I further understand that plaintiffs allege that Mr. Samuelson and Mr. Beardsley used cloud storage accounts, email, and/or external storage devices (such as external hard drives and USB drives) to copy Move documents and files from their Move laptops, and that they attempted to cover their tracks by deleting andfor wiping evidence from their computers, phones, and other devices. Stroz Friedberg has been assigned to forensically examine certain computers, cell phones, and external storage devices that were used by Mr. Samuelson and Mr. Beardsley. I, along with forensic examiners under my supervision, have performed forensic examinations of devices including: 0 An Apple MacBook Air laptop computer that Move issued to Mr. Samuelson. My understanding is that Mr. Samuelson used this MacBook laptop between November 2013 and March 5, 2014, when he resigned from Move. - A Dell Latitude laptop computer that Move issued to Mr. Samuelson along with an additional Toshiba hard drive. My understanding is that Mr. Samuelson used this Dell laptop whilst employed at Move until Mr. Samuelson replaced it with a Move issued Apple MacBook Air laptop. Prior to providing the Dell laptop back to Move, Mr. Samuelson instructed a third party computer company to create a clone ofthe original hard drive. DECLARATION OF BYRON LLOYD JON ES 2 ALAN An Apple iPad 4 device that Move issued to Mr. Samuelson. My understanding is that Mr. Samuelson used the iPad 4 whilst he was employed at Move. 0 An Apple iPhone 5 device that Move issued to Mr. Samuelson. My understanding is that Mr. Samuelson used the iPhone 5 whilst employed at Move. External USB devices which I understand to belong to and have been used by Mr. Samuelson whilst he was an employee at Move. They including a LaCie ?Rikiki? USB external hard drive, a Kingston DataTravcler USB device and a Western Digital ?My Passport" USB device. a A Dell Latitude laptop that Move issued to Mr. Beardsley. My understanding is that Mr. Beardsley used the Dell laptop whilst he was employed at Move up to March 16, 2014 when he resigned from Move. 0 An Apple iPhone 5 device that Move issued to Mr. Beardsley. My understanding is that Mr. Beardsley used the iPhone 5 whilst he was employed at Move. 4. Stroz Friedberg has found evidence that, on February 17, 2014, Mr. Samuelson connected a Verbatim ?Store Go" USB storage device] (serial number to his Move-issued MacBook laptop multiple times. We have also found evidence that, on February 27, 2014, Mr. Samuelson again connected the same Verbatim ?Store Go" USB storage device to his MacBook laptop. Log files, in particular System logs created on an Apple computer record a variety of system information, for example hardware installations, software failures and also when external USB devices are attached to an Apple computer. 5. When a USB external device is attached to an Apple computer, the System log will record information such as the date and time of the action, the name of the device and also the serial number. The System log records can be searched with the following reference A drive,? which is can also be referred to as a flash drive, is a portable storage device that either uses a hard drive or ?ash memory. In some instances. a ?ash drive can be lightweight enough to attach to a keyehain. A USB drive drives are often used for the same purposes for which ?oppy disks or (IDs were once used, for storage, data back-up and transfer ofeomputer ?les. Most USB drives can be overwritten or reformatted. which can permanently delete the contents ofthe USB drive. USB drives come in a variety ofsizes. A gigabyte ot?data is the equivalent ofa 64.000 page Microsoft Work document or short emails. DECLARATION OF BYRON LLOYD JONES 3 239R8l3? AWN to identi?ed records relating to attached USB devices. By searching the System logs on Mr. Samuelson?s Move?issued MacBook laptop for the reference, it is possible to identify when and what external USB devices have been historically attached to the laptop. 6. Stroz Friedberg?s review of the applications installed on Mr. Samuelson's Move- issued MacBook laptop identi?ed that Microsoft Of?ce 2011 suite was installed on the laptop and that the Microsoft Outlook application was last opened on March 3, 2014. Stroz Friedberg reviewed the contents of Mr. Samuelson? user pro?le on the MacBook laptop and did not identify the Microsoft User Data folder associated with the usage of the Microsoft Outlook application. This suggests that this folder has likely been deleted from the MacBook laptop. Stroz Friedberg performed a data recovery process over the MacBook laptop in an attempt to recover deleted Outlook email data and identi?ed multiple references regarding partial Outlook emails in the free space ofthe MacBook laptop. The most recent identi?ed reference was a partial email dated March 4, 2014. It is therefore likely that the Microsoft User Data folder was deleted on or after March 4, 2014 from Mr. Samuelson?s user pro?le. 7. Stroz Friedberg was able to recover some of the deleted email data, but we are not certain if we were able to recover all of the deleted items. The action of a user deleting the Outlook User Data folder results in all of the data, including emails, calendar entries, task lists, and notes, being deleted and in most instances overwritten as a result of the command, where the Operating System tells the internal storage device which blocks of data on the hard drive are no longer considered in use and can be wiped. This explains why it has not been possible for Stroz Friedberg to easily identify or recover deleted data on the MacBook laptop using forensic tools. 8. In addition, Stroz Friedberg has found evidence that Mr. Samuelson connected a LaCie Rikiki USB external device {serial number 000000002534b3a21084) to his Move-issued MacBook laptop multiple times, including on February 17, 2014, four times on March 3, 2014, and once on March 4, 2014. Based on Stroz Friedberg's analysis, Plaintiffs confirmed that the LaCie Rikiki USB external device contained Move documents. Stroz Friedberg has also found evidence that on March 4, 2014, Mr. Samuelson connected another extemal USB storage device, DECLARATION OF BYRON LLOYD JONES 4 ALAN a Chipsbank Microelectronics USB storage device {serial number to his Move?issued MacBook laptop. In sum, Stroz Friedberg has found that Mr. Samuelson connected external USB drives to his Move-issued MacBook laptop at least nine times between February 17 and March 4, 2014. 9. I understand that Mr. Samuelson states that he no longer has some of the USB drives he connected to his Move-issued laptop in the month before he resigned from Move. Without the missing USB devices, Stroz Friedberg cannot ascertain with any certainty what ?les or folders Mr. Samuelson may have copied, moved, accessed or deleted on the missing USB devices. 10. Stroz Friedberg identi?ed the use of a secure wiping tool called ?Eraser? which was run on the Toshiba hard drive regarding Mr. Samuelson's Dell laptop. Eraser is a third party program that, if appropriately used, allows users to permanently and securely wipe files and folders from a computer system such that they cannot be retrieved forensically once deleted. The Eraser program was ?rst installed and then immediately run on March 13, 2014 at 1 1:02 am. 1 l. Stroz Friedberg has analyzed Mr. Samuelson?s Move-issued iPhone 5 and iPad 4, and found that Mr. Samuelson restored the iPhone 5 and iPad 4 to factory settings, thereby permanently deleting all of the evidence on those devices, including all personal settings. text messages, voice messages, and emails. Restoring an iPhone or iPad to factory settings deletes all of the data on the device, effectively restoring it to its original unused state, 312., the state it was in when it was first purchased from the manufacturer. Because Mr. Samuelson?s Movedssued iPhonc and iPad 4 were restored to factory settings, the data on these devices was permanently deleted. After an iPhone or iPad is restored to factory settings, it is not possible to recover any of the data that was previously on the device, even using forensic tools. 12. Stroz Friedberg has found evidence that, on March 4, 2014, Mr. Beardsley connected 3 Western Digital external hard drive {serial number 5758453330384A3432333337) to his Move-issued Dell laptop. When a USB Device is connected to a computer running the Microsoft Windows Operating System, Registry keys and System logs are updated to record the DECLARATION OF BYRON LLOYD JONES 5 239118136 ALAN action of attaching the USB device to the computer. By reviewing the System logs and Registry keys, it is possible to identify when and what external USB devices have been historically attached to the laptop. I understand that Mr. Beardsley has testi?ed that the Western Digital hard drive supposedly ?failed? and that he then threw it against the wall and disposed of it at a garbage dump. In many cases, it is possible for forensic data recovery specialists to recover information from failing or broken hard drives. 13. Stroz Friedberg has also found evidence that between March 4 and March 16. 2014 Mr. Beardsley connected four other external USB storage devices to his computer, (a SanDisk Cruzer USB device (serial number 4C530300221 117101305), which was last connected on March 6? 2014 a General USB Flash device (serial number which was last connected on March 1 l, 2014; a General UDisk USB device (serial number 1 1040903095000351 7100), which was last connected on March 12, 2014 and a second SanDisk Cruzer USB device (serial number 20052242801EOE900E9E), which was connected on March 15. 2014. 14. When folders are accessed on a computer or a USB device when attached to a computer, Shellbag2 artefacts can be created in Registry databases3 located within a user?s profile, recording the folder access activity. Stroz Friedberg performed forensic analysis on the Dell laptop and identified multiple Shellbag artefacts within the User Assist Registry database for Mr. Beardsley?s user pro?le. A closer review of the Shellbag artefacts identi?ed a number of Shellbags created as a result of folder access on an external USB device attached to the Dell laptop on March 15. 2014 {highlighted in green in the chart) and also three Shellbags for folder access to an external USB device the March 4, 2014 (highlighted in orange in the chart}. This shows that a user accessed all of the folders listed on the chart below using Mr. Beardsley?s Dell laptop on the same date 2 The Windows Operating System uses a set of Registry keys known as "Shellbags" to maintain and store user preferences for a folder display such as the size. view. icon and position of a folder when using Windows Explorer. Slicllbag information is available only for folders that have been opened and closed in Windows Explorer at least one time by the user. 3 Registry databases are used by Microsoft Windows to store con?guration information about the so?warc and hardware installed on a computer. For example. they can include information regarding the desktop background. program settings. hardware settings. file extension associations. etc. DECLARATION OF BYRON LLOYD JONES 6 239118136 JED-1M 6005-131 when Mr. Beardsley?s SanDisk Cruzer USB device serial number 20052242801EOE900E9E) and also Mr. Beardsley?s Western Digital External USB device (serial number 5758453330334A3432333337) were attached to this computer on March 15, 2014 and March 4. 2014 respectively. The ?Folder Created" and ?Folder Modified" columns on the chart below list recorded ?le system dates and times for the respective folders, with the ?Folder Explored? column indicating the date and time that the folder was browsed by the user. Shellbag - Recorded Path Folder Created Folder Modified Folder Explored D:\0ropbox\Work 03/15/2014 08:26 03/11/2014 21:08 03/15/2014 D:\Dropbox\2013 Investor Day 03/15/2014 08:26 03/10/2014 13:48 03%:31314 D:\oropbox\Photos 03/15/2014 08:26 03/10/2014 13:44 03.223014 D:\Dropbox\MLS EAC 03/15/2014 08:26 09/20/2013 13:23"r 0323;2014 03/15/2014 08:26 03/10/2014 13:46 0319121022014 am 08:42 D:\Dropbox\Curt 03/15/2014 08:26 03/15/2014 0?:58 03/15/2014 08:42 D:\CBeardSIEY\Music 03/04/2014 03/04/2014 03/04/2014 16:09 16:09 16:16 D:\CBeardsley\Pictures 03/04/2014 03/04/2014 03/04/2014 16:09 16:09 16:16 D:\CBeardsley\Doeuments 03/04/201414:55 03/04/2014 03/04/2014 15:50 16:03 15. The Shellbags listed in the chart show that the respective folders were created on the same day that they were explored and that some of the folders have a reported modi?ed date and time that pre-dates the reported folder created date. For example the folder located within the ?Dropbox? folder on the USB device was created on the March 15, 2014 but was last modi?ed on September 20, 2013. This suggests that this folder and its potential contents were copied to the respective USB device first and then explored shortly after using the Dell laptop. 16. Both the SanDisk Cruzer USB device {serial number and the Western Digital External USB device {serial number 57584533303 have not been produced by Mr. Beardsley for review therefore Stroz Friedberg has not been able to DECLARATION OF BYRON LLOYD JONES 23928130 ALAN ascertain with any certainty the potential contents of the USB devices in relation to the identi?ed Shellbags on the Dell laptop. 17'. Stroz Friedberg?s analysis of Mr. Beardsley?s Move-issue laptop shows that. on March 15, 2014. Mr. Beardsley deleted his 2013 email archives from the laptop. Stroz Friedberg identi?ed that the deleted email archives were oveiwritten and therefore were not able to recover them from the Dell laptop using forensic tools. Stroz Friedberg also identi?ed evidence of the Microsoft program ?Ciphereae? being used on the Dell laptop. A feature of the Microsoft program ?Cipherasxe= is the ability to overwrite the free space of hard drive, securely erasing any deleted data on the laptop. Multiple altefacts created as result of the overwriting process were identi?ed on the Dell laptop and showed that the program was run at least ten times on the laptop, of which nine times were identi?ed between March 15. 2014 and March 17. 2014. Due to the identi?ed usage of the Microsoft program ?Cipherexe? to wipe the free space of the hard drive, it has not been possible for Stroz Friedberg to recover the contents of the identi?ed deleted files or folders using forensic tools. 18. There was also evidence on Mr. Beardsley?s Dell computer that he also used various cloud storage services and that approximately 694 documents from a Dropbox folder were deleted on the Dell laptop on March 15, 2014 (the day before he resigned from Move). One ofthe Move documents deleted in the Dropbox folder on that date is named There are also active documents named .xlsx? and ?Sortcd_ MLS on Mr. Beardsley?s Dell. 1 have been informed that a document named (AutoSaved).xlsx" was produced by Mr. Beardsley with the Bates number (38006301. 19. Stroz Friedberg?s analysis of Internet activity on Mr. Beardsley?s Move-issued Dell laptop identi?ed historical browsing activity such as performing an internet search for ?wipe free space" and also browsing websites related to ?how to clear web browser data? and also 3"d party secure wiping tools. Stroz Friedberg also identified multiple references to pornographic websites. The browsing history is attached hereto as Exhibit 2. DECLARATION OF BYRON LLOYD JONES 8 239118136 ALAN 20. In addition, Stroz Friedberg"s analysis of Mr. Beardsley?s iPhone 5 shows that Mr. Beardsley deleted numerous texts and iMessages From his iPhone 5, including a January 6, 2014 message from Mr. Samuelson that said: ?Errol here. This is my new prepaid ?burner? phone. Just sent you an email at your Beardsleynet account. Would like your feedback." Stroz Friedberg was able to recover this text from Mr. Beardsley?s iPhone 5. A true and correct copy of the text message recovered from Mr. Beardsley?s iPhone 5 is attached hereto as Exhibit 3. 21. Similarly. Stroz Friedberg?s analysis of Mr. Beardsley?s iPhone 5 and Mr. Samuelson?s Move-issued MacBook laptop did not identify the following iMessage sent by Mr. Samuelson to Mr. Beardsley: ?I?ve been thinking and it probably is best not to send emails {or even text messages) on this topic since someone could. in hindsight, try to dig up (or subpoena) the emails (or text messages which apparently are archived on my iMac) and make the case that we were not working in the company?s best interests, no matter how erroneous that perspective would I understand that Mr. Beardsley produced this iMessage as part ot?a spreadsheet with the Bates number (38008556. A true and correct copy of this iMessage is attached hereto as Exhibit 4. It is unclear how Mr. Beardsley?s attorneys obtained this iMessage since Stroz Friedberg has not identi?ed the iMessage on any of the devices produced by Mr. Samuelson or Mr. Beardsley. It is likely that Mr. Beardsley?s attorneys recovered this message from Mr. Beardsley?s personal iPad since (33008556. the "?le name" metadata for the spreadsheet containing this iMessage, is (ID 95313) (ID 1441 22. Stroz has recovered some of Mr. Beardsley's deleted text messages, chats and iMessages but has not been able to recover all of them or all of the data associated with each text, chat or iMessage. For much ot?the missingl?deleted information, it is unrecoverable due to the nature of record deletions in SQLite databases {the technology that most of the data on smartphones and tablets is stored). In some instances the deleted records still exist within the SQLite database, but the speci?c information required to link the data to other data in other tables in the SQLite database (for example the sender or recipient of the text messages} is lost and therefore cannot be reliably recovered using forensic tools. DECLARATION OF BYRON LLOYD JONES 9 239R8l3? JAB-it?d ?300me declare under penalty of perjury under the laws of the State of Washington that the foregoing is true. DATED January 8, 2016. Byron Lloyd-J ones DECLARATION OF BYRON LLOYD JONES 10 CERTIFICATE OF SERVICE hereb}r certify that on January 8, 2016, the foregoing was hand delivered under seal with the Clerk of the Court and an electronic copy served by email transmission at the email addresses provided thereto: Counsel for Zillow, Inc. Karin S. Aldarna Amanda J. Beane David J. Burman Ulrike B. Connelly Susan E. Foster Katherine G. Galipeau Mary P. Gaston John H. Gray Nicholas Hesterberg Judith B. Jennison Joseph M. McMillan Kathleen M. O?Sullivan David A. Perez PERKINS COIE LLP 1201 Third Avenue, Suite 4900 Seattle, WA 98101-3099 T: 206359?8000 F: 206-358-9000 kaldama@perkinscoie.com abeane@oerkinscoie.com dburman perkinscoie.com uconnellv@perkinscoie.com sl'oster@perkinscoiecom kealipeau@oerkinscoie.com measth @perkinscoiecom iharav perkinscoie.com nhesterberg?perkinscoiexom iiennison@nerkinscoie.coni jmcmillan@perkinscoiecom kosullivan@perkinscoie.com dperez@uerkinscoiecom DECLARATION OF BYRON LLOYD JONES - l] Counsel for Errol Samuelson Clemens H. Barnes Brian W. Esler K. Michael Fandel Estera Gordon MILLER NASH GRAHAM DUNN LLP Pier 70, 2801 Alaskan Way, Suite 300 Seattle, WA 98121-1128 T: 206?324-8300 F: 206-340-9599 clemharnes @millernash.com brianesler@millernash.com michaelfandel@millernash.c0m estera. eordon millernash.com robert.mittenthal millernash .com conniehavs@millernash.com gill.fadaie@millernashcom dormacauthorn@millernash.com Counsel for Curt Beardsley Brandi Balanda Duffy Graham Caitlin Hawks James P. Savitt Michele Stephen SAVITT BRUCE 8r WILLEY LLP Joshua Green Building 1425 Fourth Avenue, Suite 800 Seattle, WA 93101-2272 mstephen@ Counsel for Plaintiff Jack M. Lovejoy Lawrence R. Cock CABLE, LANGENBACH, KINERK BAUER, LLP 1000 Second Avenue Bldg, Suite 3500 Seattle, WA 98104-1048 T: 206?292?8800 F: 206-292-0494 iloveiov@cablelanecom LRC kalbritton @cablelang.com Counsel for Plaintiff Brent Caslin Richard Lee Stone Jeffrey A. Atteberry Jennifer Wagman Njathi Ethan A. Glickstein AnnaMarie Van Hoesen Amy M. Gallegos John S. Lee Christopher S. Lindsay Daniel A. Rozansky Nick G. Saros David R. Singer Andrew J. Thomas JENNER 8.: BLOCK LLP 633 West 5th Street. Suite 3600 Los Angeles. CA 90071 T: 213-239?5150 beaslin iennencom stone@jenner.com iatteherrv ienner.com in iathi iennercom e?elickstein ienner.eom avan hoesen ienner.com aeallegos @ienner.com jslee@ienner.com cli11dsay?ien11er.eom drozauskv ienner.com nsaros@iennercom dsinger?ienne11com ailhomas@ienner.com eward@ienner.com DECLARATION OF BYRON LLOYD JONES - 12 Counsel for Plaintiff Michael Rosenberger Jeffrey M. Thomas Jeffrey 1. Tilden Mark Wilmer GORDON TILDEN THONIAS CORDELL LLP 1001 Fourth Avenue, Suite 4000 Seattle, WA 98154 iti lden aordontildeneom nn'osenherger?? gordonti den.com ithomas@aordontildeneom mwilner eordontildeneom Counsel for Plaintiff James E. Lobsenz Gregory M. Miller CARNEY BADLEY SPELLMAN, RS. 701 Fifth Avenue, Suite 3600 Seattle, WA 98104-7010 lohsenz@eameylaw.com miller@earnevlawxom saiden@carnevlawcom declare under penalty of perjury under the laws of the State of Washington that the foregoing is true and correct. DATED at Seattle, Washington on January 8, 2016. DECLARATION OF BYRON LLOYD JONES - l3 s/Karv Albrmon Katy Albritton, Legal Assistant CABLE, LANGENBACH, KINERK 81 BAUER, LLP 1000 Second Avenue Bldg, Suite 3500 Seattle, Washington 98104 T: 206-292-8800 F: 206-292-0494 E: kalbritton@cahlclana.com EXHIBIT 1 STROZ FRIEDBEIES Byron Lloyd-Jones DIRECTOR PR FE HAL EXPERIEN STROZ FRIEDBERG LTD Director, November 2015 to Present Assistant Director, Digital Forensics, January 2012 to October 2015 Team Leader, Digital Forensics, April 2011 to December 2011 Digital Forensic Examiner, January 20053I to March 2011 Previousiy: Technical Consultant, Data Genetics international Ltd, June 200.? to December 2008 London, UK Responsible for the co-ordination and supervision of a team of Digital Forensic Examiners along with day-to-day operations within Stroz Friedberg?s London forensic lab. Conduct digital forensic acquisitions, examinations, and analyses of data from digital media devices including, but not limited to laptops, desktops, servers, and mobile devices. Carry out large-scale multi-terabyte electronic disclosure involving the preservation, processing, and production of electronic data for major law firms and FTSE 100 firms. Liaise with numerous law enforcement agencies for criminal matters as well as assisting clients with internal investigations, civil proceedings, large scale eDisclosure projects, delivery- up and civil search orders and internal security audits. Led matters concerning forgery, intellectual property theft, breach of contract, spoliation, fraud, and unauthorised access to computer systems. Authored numerous witness statements. technical reports. and expert witness reports, used in corporate investigations. criminal matters, and civil proceedings. Undertook work throughout the United Kingdom and internationally including the United States. Russia. Dubai. Antigua. Switzerland. South Africa. Uzbekistan. Poland and various other European countries. Significant Casework includes: 0 Investigation into the authenticity of emails sent by a high profile recording artist. actress. and fashion designer to an ex?employee of their entourage related to their purported behavior during their employment as part of a litigation between both parties - Assisted in a pest incident response and internal data audit review for a FTSE 100 major UK food retailer with over 500 stores to ensure no internal customer data loss occurred during the incident and to assist with a security review of the internal network and infrastructure - investigation into breach of trust and conflict of interest for one of the largest providers of private healthcare spanning two countries involving the identification and remediation of data from one of the big four international professional services companies - Led the UK forensic collections and analysis for an international Foreign Corrupt Practices Act (FCPA) investigation for a NASDAQ?quoted Technical System Software company - Assisted in a DOJ investigation into an International Cruise Line company for the possible violation of environmental laws in connection with alleged discharge of waste from cruise ships - Assisted in a Global Anti-Corruption review for a major international automotive corporation, involving international travel overseeing the compliance of large data collections Capital House. 85 King William Street. London. EC4N TESL T: +44 20.?0612233 strozfricdoorgcom STROZ FRIEDBEIES Byron Lloyd-Jones DIRECTOR - Investigation involving a malicious software infection at a top 20 Law firm in the UK due to a phishing scam via email. involving in-depth testing to determine the severity of the malicious software and what threat it posed to the rest of the Law firm. - Assisted in an international investigation into the misuse of wireless data capture that was the focus of national and international Governmental inquiries. spanning multiple countries against a large software company. - Assisted the Serious Fraud Office?s Digital Forensic Unit in a multi?million-pound price fixing fraud investigation by providing technical forensic support. restoring data from a variety of backup tapes and converting various file formats. - Led multiple internal investigations within a multi-national bank, including extensive international fraud, involving covert and overt data collections for multiple custodians both domestically and internationally. - Assisted in a team defection and fraud investigation involving multiple onsite locations for data collection for a major pharmaceutical company. - Assisted in a team defection investigation at an international financial institution. involving the potential theft of millions of pounds of intellectual property. - Assisted in a large eDisclosure case involving 50 custodians and over 8 terabytes of data for a large investment firm. - Assisted and lead in multiple Search Orders at residential and business sites. - Seconded to one of the U5. offices for three months assisting on multiple high profile forensic and eDisclosure cases, including a multi?million dollar case for a leading global financial institution, investigation multiple custodians for IP theft including a highly valuable program code. - Assisted with a large US. Investigation into a million dollar contractual dispute for an external supplier within the hotel construction industry. - Consulted on many high-profile cases both domestically as well as internationally, taking me to various locations around the world including the United States. Russia, Dubai. Antigua. Switzerland. South Africa, Uzbekistan. Poland and various other European countries. ERTIFI ATI Microsoft Certified Professional (MCP). Microsoft, 2010 EnCase Certified Examiner Guidance Software, 2009 Capital House. 85 King William Street. London. EC4N Blond-jores@strozfriodbergcom T: +44 2030612233 strozfriodoorgcom STROZ FRIEDBERG CV Byron Lloyd-Jones DIRECTOR EDU ATI NOTTINGHAM TRENT UNIVERSITY Hons, Forensic Science. 2006 TRAININE Internal Firmwide Training Program Attend weekly in-house training presentations on digital forensics, cybercrime response, computer security, desktop and network forensics tools, and relevant legal topics. External Training Programs SANS FOR508: Advanced Digital Forensics and Incident Response, Jul 2015 Windows Malware and Memory Forensics, Volatility Labs, Sep 2014 Mastering Macintosh Forensics, May 2013 Computer and Enterprise Investigations Conference (CEIC), May 2011 London School of Computer Education (LSCE), Microsoft Certified Systems Engineer Part time course, (MSCE), Aug 2010 EnCase Network Intrusion Investigations. Guidance Software. November 2008 EnCase Advanced Internet Examination, Guidance Software, August 2008 EnCase Examination of NTFS. Guidance Software, August 2008 EnCase Advanced Computer Forensics. Guidance Software. June 2008 EnCase Forensics ll, Guidance Software. May 2008 CV Version 10f2015 Capital House, 85 King Wil iar?ri Street, Lor'idori. 12th BI T: ?44 2070812233 strozfriodoorgcom EXHIBIT 2 Sheetl URL Date Other Information freeones.com amyreid-blog.com Sf25f2012 xhamster.com QISKZOIZ femjoyrom 10f9f2012 mvfreecamsmm 10/19f2012 errotica?archives.com 11/11f2012 alisonangel.com 2f24f2013 elegantangel.mm kindgirlsrom NSKZOIB 10/31f2013 111111013 11/1f2013 reads! 11/1f2013 Livejasm?ln?com 11f2f2013 straponpussies.corn 11(301'2013 12f9f2013 1219;9013 12f9f2013 1212312013 Alice eve nude 12/31f2013 Google Search format sandisk cruzer 12131/2013 Google search 15/2014 How do I clear my web browser's cache, cookies, and history? 1f 51'2014 http:Hclasswasfuckiumblmom/ 1/19f2014 Emilia Clarice Nude 2,16,!2014 Google Search Rachel McAdams nude- 2f5/2014 Google Search Daenervs Targaryen nude HERON Google Search wipe free space 3.1612014 Bing search xhamster.com 3,19,!2014 Pornographic Video website- formal letter of resignation 3/15/1014 Bing Search Ex. EXHIBIT 3 279 SMS Messages {3826) {Pd 2 ?3172014 lTim ?53201 3 1039249 SMS Messages Raad Errol ham This is my nawprapald "burner" phms. Deleted Just sent you an small your Baardslaynet amuunt. Would lice yuu?r Inadbank. Ex. Beardsiay IPhone Summary Reporulau EXHIBIT 4 Tumelna . Pall [Ir-urnIIc-vl Humans Mhmlumamupmuy In heal mamas-rill: mm mums] unhmum museum. hm.whduupmm]mm [en-mu mm!? mud be. El OUTSIDE COUNSELS SHOW