Preview
FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305
NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020
SUPREME COURT OF THE STATE OF NEW YORK
COUNTY OF DELAWARE
TOSHIYUKI SHIOYA, | INDEX NO. 2016-305
|
Plaintiff, |
|
v. |
HANAH COUNTRY INN MANAGEMENT |
CORPORATION, DEBRA STORMS, YU |
NAGASAKA, FOX, HORAN & CAMERINI, |
LLP and CHIZUKO S. UENO, |
|
Defendants. |
HANAH COUNTRY INN MANAGEMENT |
CORPORATION and YU NAGASAKA, |
|
Counterclaim Plaintiffs, |
|
v. |
TOSHIYUKI SHIOYA, |
|
Counterclaim Defendant. |
AFFIDAVIT OF ANDREW REISMAN
I, ANDREW REISMAN, being duly sworn, state under penalty of perjury as follows:
1. The matters set forth in this affidavit are based on my personal knowledge and
expertise. If called to testify as a witness in this matter, I would testify to the facts set forth herein.
2. I am the CEO of ELIJAH, a company specializing in digital forensics,
cybersecurity, and information technologies expert services. I am an expert in digital forensics.
My curriculum vitae is attached as Exhibit A.
3. Counsel for Defendants/Counterclaim-Plaintiffs (“Counter-Plaintiffs”) engaged
ELIJAH to perform digital forensic analysis relating to a forensic image of the hard drive from a
computer assigned to Toshiyki Shioya (“Shioya”) while working for Hanah Country Inn
Management, identified as “Toshiyuki_Shioya_Desktop_Physical_CDSFSG000006852” (the
“Shioya Drive”). A forensic image is an exact copy of the entire contents of an electronic storage
1 of 5
FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305
NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020
device, in this case a hard drive, including areas of the drive in which potentially deleted data
resides. Forensic images contain built-in verification functionality that enables digital forensic
examiners to confirm using a form of digital fingerprinting, known as MD5 hash value
comparison, that the data on the forensic image is identical to that of the original device. Custody
of the Shioya Drive was transferred to me via an encrypted hard drive, the passcode for which I
received from the vendor that performed the forensic imaging, and after entering the decryption
passcode I performed MD5 hashing validation to confirm that the forensic image of the Shioya
Drive was identical to the original drive.
4. As part of my examination of the Shioya Drive, I indexed the data stored thereon
using Nuix forensic software. Nuix is software widely used and accepted in the digital forensics
industry for indexing the contents of electronic storage devices and performing comprehensive
searches for data stored thereon.
5. After imaging data on the Shioya Drive, I performed a search for various search
terms that my client provided, which are attached as Exhibit B. My understanding is that counsel
for Counter-Plaintiffs designed these search terms to identify whether account and order
information associated with certain purchasing activity by Shioya was present on the Shioya Drive
as requested in Counter-Plaintiffs’ document requests and interrogatories (the “Responsive Data”).
I determined that one of the search terms, “ID”, was generating hundreds of thousands of hits, and
re-ran the searches without that term. In my judgment and experience, the remaining search terms
were amply sufficient to identify any Responsive Data on the Shioya Drive.
6. After applying the search terms to the indexed data from the Shioya Drive, I
exported the documents with hits and provided them to counsel’s data hosting vendor for review
in the Relativity document review platform. A listing of exported files containing files with search
2
2 of 5
FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305
NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020
hits for the various shopping and hotel websites, which files were provided for review, is attached
as Exhibit C,
7. Counsel for Counter-Plaintiffs then reviewed the files I provided, and excluded
“false positive” documents, i.e. documents that happened to contain one or more search terms but
that did not constitute Responsive Data. Listings of such Responsive Data by category follows,
which I confirmed were derived from the data I exported from the Shioya Drive:
a. Airlines: 28 files, as set forth in Exhibit D.
b. Amazon Japan: 3 files, as set forth in Exhibit E.
c. Amazon: 119 files, as set forth in Exhibit F.
d. Crate & Barrel: 39 files, as set forth in Exhibit G.
e. Expedia: 15 files, as set forth in Exhibit H.
f. Hotels: 40 files, as set forth in Exhibit I.
g. Japan Airlines Shopping: 10 files, as set forth in Exhibit J.
h. Rakuten: 78 files, as set forth in Exhibit K.
i. Ticketmaster: 10 files, as set forth in Exhibit L.
j. Trip Advisor: 1 file, as set forth in Exhibit M.
k. Other Shopping: 13 files, as set forth in Exhibit N.
l. Shopping Advertisements: 135 files, as set forth in Exhibit O.
m. Login Password Related: 1 file, as set forth in Exhibit P.
8. I did not identify any files on the Shioya Drive that listed all shopping account
logins and passwords that Shioya used, as Counter-Plaintiffs had requested in their interrogatories
and document requests. Moreover, even if I forensically could recover potential account
passwords, my understanding is that legally I could not attempt to test whether any such credentials
3
3 of 5
FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305
NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020
are valid without Shioya’s consent. Such a process also would be time consuming and expensive,
whereas as the owner of each account, Shioya easily could contact each company to recover and/or
reset his passwords, and provide the requested information to counsel for Counter-Plaintiffs. The
companies identified in Paragraph 6 herein have mechanisms on their websites whereby users can
indicate that they have forgotten their passwords and create new ones, as users routinely need to
recover and/or change account passwords.
9. My understanding is that during the course of his employment, Shioya submitted
hundreds of receipts claiming reimbursement for alleged expenses, and has asserted that
documentation supporting the validity of those receipts is stored on the Shioya Drive. My further
understanding is that the review performed by counsel for Counter-Plaintiff of files I exported
identified only one receipt file. I performed additional investigation to determine if any receipt or
reimbursement files were on the Shioya Drive that were not identified due to the files not
containing search hits for any of the terms on Exhibit B. I first searched for any folders on the
Shioya Drive containing the words “receipt”, “receipts”, “reimbursement”, or “reimbursements”,
and determined that no such folders were on the drive. I performed a search for any file names on
the Shioya Drive containing those words, and identified only three additional substantive files.
One of those files was a February 2012 receipt from Louis Vuitton with the description
“Evelop.C.Visites.Damier” in the amount of $239.53, and two were receipts from You-lng Travel
Services for August 2014 travel on Air Nippon Airlines between New York and Tokyo, one in the
amount of $1561.50 for one individual, and the other in the amount of $4283.30 on the same flight
for three other individuals. I identified no evidence on the Shioya Drive of documentation
supporting the hundreds of reimbursement requests that I understand Shioya submitted during the
course of his employment.
4
4 of 5
FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305
NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020
AFFIANT SAYETHNAUGHT.
FURTHER
rew Reisman
Dated: 16, 2019
July
OFFICIAL SEAL
MARILYN LENTINI
Public - State of Illinois
Notary
My Commission Expires 4/06/2022
.... - - - - - - - -
5
5 of 5
Preview
FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305 NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020 SUPREME COURT OF THE STATE OF NEW YORK COUNTY OF DELAWARE TOSHIYUKI SHIOYA, | INDEX NO. 2016-305 | Plaintiff, | | v. | HANAH COUNTRY INN MANAGEMENT | CORPORATION, DEBRA STORMS, YU | NAGASAKA, FOX, HORAN & CAMERINI, | LLP and CHIZUKO S. UENO, | | Defendants. | HANAH COUNTRY INN MANAGEMENT | CORPORATION and YU NAGASAKA, | | Counterclaim Plaintiffs, | | v. | TOSHIYUKI SHIOYA, | | Counterclaim Defendant. | AFFIDAVIT OF ANDREW REISMAN I, ANDREW REISMAN, being duly sworn, state under penalty of perjury as follows: 1. The matters set forth in this affidavit are based on my personal knowledge and expertise. If called to testify as a witness in this matter, I would testify to the facts set forth herein. 2. I am the CEO of ELIJAH, a company specializing in digital forensics, cybersecurity, and information technologies expert services. I am an expert in digital forensics. My curriculum vitae is attached as Exhibit A. 3. Counsel for Defendants/Counterclaim-Plaintiffs (“Counter-Plaintiffs”) engaged ELIJAH to perform digital forensic analysis relating to a forensic image of the hard drive from a computer assigned to Toshiyki Shioya (“Shioya”) while working for Hanah Country Inn Management, identified as “Toshiyuki_Shioya_Desktop_Physical_CDSFSG000006852” (the “Shioya Drive”). A forensic image is an exact copy of the entire contents of an electronic storage 1 of 5 FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305 NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020 device, in this case a hard drive, including areas of the drive in which potentially deleted data resides. Forensic images contain built-in verification functionality that enables digital forensic examiners to confirm using a form of digital fingerprinting, known as MD5 hash value comparison, that the data on the forensic image is identical to that of the original device. Custody of the Shioya Drive was transferred to me via an encrypted hard drive, the passcode for which I received from the vendor that performed the forensic imaging, and after entering the decryption passcode I performed MD5 hashing validation to confirm that the forensic image of the Shioya Drive was identical to the original drive. 4. As part of my examination of the Shioya Drive, I indexed the data stored thereon using Nuix forensic software. Nuix is software widely used and accepted in the digital forensics industry for indexing the contents of electronic storage devices and performing comprehensive searches for data stored thereon. 5. After imaging data on the Shioya Drive, I performed a search for various search terms that my client provided, which are attached as Exhibit B. My understanding is that counsel for Counter-Plaintiffs designed these search terms to identify whether account and order information associated with certain purchasing activity by Shioya was present on the Shioya Drive as requested in Counter-Plaintiffs’ document requests and interrogatories (the “Responsive Data”). I determined that one of the search terms, “ID”, was generating hundreds of thousands of hits, and re-ran the searches without that term. In my judgment and experience, the remaining search terms were amply sufficient to identify any Responsive Data on the Shioya Drive. 6. After applying the search terms to the indexed data from the Shioya Drive, I exported the documents with hits and provided them to counsel’s data hosting vendor for review in the Relativity document review platform. A listing of exported files containing files with search 2 2 of 5 FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305 NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020 hits for the various shopping and hotel websites, which files were provided for review, is attached as Exhibit C, 7. Counsel for Counter-Plaintiffs then reviewed the files I provided, and excluded “false positive” documents, i.e. documents that happened to contain one or more search terms but that did not constitute Responsive Data. Listings of such Responsive Data by category follows, which I confirmed were derived from the data I exported from the Shioya Drive: a. Airlines: 28 files, as set forth in Exhibit D. b. Amazon Japan: 3 files, as set forth in Exhibit E. c. Amazon: 119 files, as set forth in Exhibit F. d. Crate & Barrel: 39 files, as set forth in Exhibit G. e. Expedia: 15 files, as set forth in Exhibit H. f. Hotels: 40 files, as set forth in Exhibit I. g. Japan Airlines Shopping: 10 files, as set forth in Exhibit J. h. Rakuten: 78 files, as set forth in Exhibit K. i. Ticketmaster: 10 files, as set forth in Exhibit L. j. Trip Advisor: 1 file, as set forth in Exhibit M. k. Other Shopping: 13 files, as set forth in Exhibit N. l. Shopping Advertisements: 135 files, as set forth in Exhibit O. m. Login Password Related: 1 file, as set forth in Exhibit P. 8. I did not identify any files on the Shioya Drive that listed all shopping account logins and passwords that Shioya used, as Counter-Plaintiffs had requested in their interrogatories and document requests. Moreover, even if I forensically could recover potential account passwords, my understanding is that legally I could not attempt to test whether any such credentials 3 3 of 5 FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305 NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020 are valid without Shioya’s consent. Such a process also would be time consuming and expensive, whereas as the owner of each account, Shioya easily could contact each company to recover and/or reset his passwords, and provide the requested information to counsel for Counter-Plaintiffs. The companies identified in Paragraph 6 herein have mechanisms on their websites whereby users can indicate that they have forgotten their passwords and create new ones, as users routinely need to recover and/or change account passwords. 9. My understanding is that during the course of his employment, Shioya submitted hundreds of receipts claiming reimbursement for alleged expenses, and has asserted that documentation supporting the validity of those receipts is stored on the Shioya Drive. My further understanding is that the review performed by counsel for Counter-Plaintiff of files I exported identified only one receipt file. I performed additional investigation to determine if any receipt or reimbursement files were on the Shioya Drive that were not identified due to the files not containing search hits for any of the terms on Exhibit B. I first searched for any folders on the Shioya Drive containing the words “receipt”, “receipts”, “reimbursement”, or “reimbursements”, and determined that no such folders were on the drive. I performed a search for any file names on the Shioya Drive containing those words, and identified only three additional substantive files. One of those files was a February 2012 receipt from Louis Vuitton with the description “Evelop.C.Visites.Damier” in the amount of $239.53, and two were receipts from You-lng Travel Services for August 2014 travel on Air Nippon Airlines between New York and Tokyo, one in the amount of $1561.50 for one individual, and the other in the amount of $4283.30 on the same flight for three other individuals. I identified no evidence on the Shioya Drive of documentation supporting the hundreds of reimbursement requests that I understand Shioya submitted during the course of his employment. 4 4 of 5 FILED: DELAWARE COUNTY CLERK 09/30/2020 04:41 PM INDEX NO. EF2016-305 NYSCEF DOC. NO. 212 RECEIVED NYSCEF: 09/30/2020 AFFIANT SAYETHNAUGHT. FURTHER rew Reisman Dated: 16, 2019 July OFFICIAL SEAL MARILYN LENTINI Public - State of Illinois Notary My Commission Expires 4/06/2022 .... - - - - - - - - 5 5 of 5