Case 2:16-cv-02108-JAR-GLR Document 70-4 Filed 02/24/17 Page 1 of 3

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF KANSAS

KASEY KING,

Plaintiffs,
Case No. 16-2108-JAR-GLR
v.

LORI BOLTON FLEMING, et al.

Defendants.

Atfidavit of Jeffrev L. Johnpon of Quantum

1 . I, Jeffrey Johnson, am Principal Consultant of Quantum. In my capacity as
Principal Consultant, my primary responsibilities include the preservation, collection, analysis
and search of ESI (Electronically Stored Information), and advising litigants and corporations
subject to regulatory investigation and litigation with regards to the same. During my l8-year
career, I have personally collected and investigated over 50TB of electronically stored
information ("ESI"). I have personally collected or managed the collection and analysis of over
two thousand electronic mailboxes. In an efforl to advance ethics related to the preservation,
collection, search and production of ESI, I have authored articles in regional and national
publications relating to electronic investigations. I am a Certified Computer Examiner (CCE,
#1287), an Access Data Cerlified Examiner (ACE), and a member of the International Societv of
Forensic Computer Examiners@.

2. Quantum is a professional electronic discovery consultancy and services company

based in Overland Park, KS. The focus of the practice is on delivering intelligent electronic
discovery collection, data analysis and advisory services to corporations, law firms and
govemment entities.

3' I have been asked by Plaintiffs in the case at hand to determine whether the
Defendant and/or their representatives modified, altered, or tampered with the specific e-mail
message. In the computer industry, the term "modified" is a term of art that means that a
computer file has been changed and then saved.

4. I received the e-mail message in question from Adebayo Ogunmeno, attorney for
Plaintiffs. To insure a proper chain of-custody, I imaged the original CD-R.OM that he received
fiom Defendants' using AccessData@ FTK@ Imager 3.1.1.8. The File Size reported by FTK@
Imager 3.1.1.8 is 1,486,848 bytes, with a Logical Block Count of 128. I processed the image
using AccessData@ Forensic Toolkit@ version 6.0.1.30 (hereafter "FTK"). The e-mail message
has a S HA- t hash of 692 1 87 I 12ba3 6b9 a3 fab6e01 f1 c09ff60 57 t2d24.
 Case 2:16-cv-02108-JAR-GLR Document 70-4 Filed 02/24/17 Page 2 of 3

Affidavit of Jeffrey L. Johnson

5. I have reviewed Defendant The Honorable Lori Fleming's Answers to Plaintiff s

First Set of Interrogatories To Defendant Lori Fleming (hereafter referred to as "Interrogatory"),
the e-mail message in question (provided to me in .MSG forn as "100.7 ESPN.msg") and two
printout images t':*'ff
:;::i[1|1fr
,#Hru:ldencetop raintirl pdr

6. In her Answer to plaintiff s Interrogatory No. 13, Judge Fleming states:

"Following my counsel's instructions, I went to my "sent" folder in Microsofi Outlook on my
office computer in Pittsburg, clicked on the original email, and dragged it to my Windows
desktop so that Windows copied it to the desktop. Then I opened a new email in Outlook,
dragged the copied email from the desktop to the new email, and Windows attached it to the new
email. I then addressed the email to my counsel Stephen Phillips and sent it to him."

l. The MSG and two printout images of the e-mail to which Judge Fleming refers to
two specific individuals in the To and From fields: Lori Fleming and Bill Wachter.

8. However, FTK reports a "Phillips, Steve" in the file attribute "Last Modifier
Name" (a common attribute to investigate when reviewing files for tampering, modification and
alteration). The following image is a screen capture from FTK:

El MSG/Outlookr'txchanqe Attributes
r'.Llnrnndifl*d
5ubnrit
Frorrr lul,*
;.,.i
:rReserrd
)tfr0*l' f.fn.lll A':dl e:i:i
'til
r' ,Srnt R*prrsxnting Ern*li Address
;'l:' :

5end Ref,resentinq llenr*

f'lessaEe {lass
Ccnverloticn Tc'Fic

5*-r1d*r' fr,leme

C*nver:*tiun lndex 'ii;r'-ll ,i

9. "Phillips, Steve" is not mentioned in either of the printout images of the e-mail
pro duc e d o'
" ""1 "'i];ili;l?
i? l:,:ffi; 5:1ff;i:ldenceto p r ainti rr p dr

10. Steve Phillips modified the .MSG e-mail (provided by Defendants Counsel to
Plaintiffs Counsel via CD-ROM) because his name appears in the Last Modifier Name field in
 Case 2:16-cv-02108-JAR-GLR Document 70-4 Filed 02/24/17 Page 3 of 3

Affidavit of Jeffrey L. Johnson

the metadata of the e-mail. If Steve Phillips had not modified the file, his name would not have
appeared in the Last Modifier Name field.

11, As I articulate in Paragraph Number 12 below, the fact that Steve Phillips
modified the .MSG file raises two plain questions that I must address in order to determine
whether the .MSG e-mail file has been tampered with or altered.

12. Why does Steve Phillips' name appeatin this .MSG? What action was taken by
Steve Phillips that resulted in his name being referenced as the last person that modified this file?

13. Based on my findings, the .MSG e-mail provided by Defendants Counsel to

Plaintiffs Counsel via CD-ROM cannot be the original e-mail sent from Judge Fleming to Bill
Wachter on February 19,2015.

14. The only way I would be able to make a sound determination as to whether the
content of the original e-mail was altered or tampered with would be by examining:

. The computer that Judge Fleming used to send the original e-mail sent from Judge
, Fleming to Bill Wachter on February 19,2015.
. The computer that Steve Phillips used to modify the e-mail provided by
Defendants Counsel to Plaintiffs Counsel via CD-ROM.

Further affiant saith not.

I SWEAR OR AFFIRM THAT THE ABOVE AND FOREGOING REPRESENTATIONS

ARE TRUE AND CORRECT TO THE BEST OF MY INFORMATION. KNOWLEDGE.
AND BELIEF.

SUBSCRIBED AND SWORN to before me this 23ldday of February,2017, by Jeffrey

Johnson.

Sworn to and subscribed before me

ot ftbrw{
'..ZorzUyd.*i=
trls %ily
t.(F*-', Notary Public
*7'*
who is personally knowrVppduced identiffcalion.

Signed

Stoqe Ils -
"$
G.--, "$.JPL'rsort
I

NOTARY PUBUC . ShtE Of Kg|sAS

BI.AKE UMEAUGI
Ny lppt. expires? l'"iL I