IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF KANSAS

KASEY KING, )
)
Plaintiffs, )
) Case No. 16-2108-JAR-GLR
v. )
)
LORI BOLTON FLEMING, et at. )
)
Defendants. )
)

Affidavit of Jeffrgy I-,. Johnson of Ouantum

1. I, Jeffrey Johnson, aln Principal Consultant of Quantum. At Quantum, ffiy

practice centers primarily on the collection, analysis and production of e-mail on behalf of
responding parties. During my 18-year career, I have helped corporations respond to discovery

requests in over 500 cases involving electronic mail.

2. I received the e-mail message in question from Adebayo Ogunmeno, attorney for

Plaintiffs on Febru ary 17 , 20f 7 (MD5 hash of 02C89FCE88 20g10t237g1 40506401 485: SHA-

t hash of 692l87712ba36b9a3fab6e0l fl c09ff605 712d24). I then examined the file and found

that these software tools list Steve Phillips as having modified the file:

. AccessData@ Forensic Toolkit@ version 6.0.1

o MFCMAPI x86 17.0.17033.02

3. I have reviewed the following documents:

. Defendant Lofi Bolton Fleming's Response To Plaintiffls Motion To Alter

and Amend (File d 02127 ll7) (Hereafter, "DocumentT l ")

{00616718. DOCX;-1}
Affidavit of Jeffrey L. Johnson

o Memorandum of Defendants My Town Media, Inc., in Opposition to

Plaintiff s Motion for Reconsideration and Motion for Sanctions Against

Plaintiff s Counsel (Filed 02127117) (Hereafter, "Document72")

4. On page 2, paragraph 3, of DocumentTl, Steve Phillips states "The only

implication of the Reports is that the email was forwarded from Fleming to this counsel, which is

standard practice in civil discovery" (Emphasis his; Document 71, at2). In my professional

opinion, the method Mr. Phillips describes (clients forwarding their e-mail to their counsel) is an

iniproper practice because it modifies the original evidence.

5. The standard practice in proper e-Discovery is to collect the electronic evidence

from the original sourcel. This is critical in e-Discovery because if the collection of an e-mail is

performed after the e-mail was transmitted through internet servers and then copied to another

machine, the properties of the file will be modified, making aproper and accurate forensic

analysis of the original e-mail impossible.

1On page 58 of his "Lawyer's

Guide to Forms of Production" Craig Ball sets forth an "Exemplar

Production Protocol". One of the metadata fields he lists as part of his standard data file given to

opposing parties is "Path". He describes Path as "E-mail: Original location of e-mail including

original file name." In addition, Brian Carrier, in his book "File System Forensic Analysis",

states that "Acquisition typically occurs during the System Preservation phase of an investigation

and is one of the most important phases in a digital forensic investigation because if data are not

collected from the system, they could be lost and therefore not recognized as evidence. Further,

if data are not collected properly, their value as legal evidence is diminished."
Affidavit of Jeffrey L. Johnson

6. The original e-mail is on Judge Bolton's computer (to the extent it has been

preserved), and must be collected directly from her computer for forensic tests and analysis to

determine if there were any modification or alterations.

I SWEAR OR AFFIRM THAT THE ABOVE AND FOREGOING REPRESENTATIONS

ARE TRUE AND CORRECT TO THE BEST OF MY INFORMATION, KNOWLEDGE.
AND BELIEF.

DATED 76
ui, .-- day of Mrrd' 20t7.

SUBSCRIBED AND SWORN to before me this 9th day of March,2}l7,by Jeffrey

Johnson

MITAFV R g.*E. Sbb of l(g|sas

Notary Public