slaventh floor porsland, oregon 97206-3141 renutle, washington eu 503 228 9959 rx $03 226 0259 washingion. de beijing, china sew york, new york M PAnYHERs4ie OF PROPER SIONAL CORPORATIONS panier age ‘Menffmen@gsbiow com TE ext 3230 May 14, 2009 Donna Maddux Attomey in Charge, Organized Crime Section Criminal Division Oregon Department of Justice 610 Hawthome Avenue, SE, Suite 210 Salem, OR 97301 Re: Portland Mayor Sam Adams ‘Dear Ms, Maddux: 1 vite in response to your request for information about the Mayor’s two personal computers and the notebook computer issued to him by the City, as well es the Mayor's Treo PDA and to provide you with some additional records. We received the computers from Mayor Adams on January 23, 2009. We then tumed them over to our expert, Robert Young, on January 24, 2009. Mr. Young’s forensic imaging of the hard drives from the three computers is detailed in his declaration, enclosed. Mr. Young returned the computers to our offices on January 28, 2009, While the computers were in our custody, we kept them in a locked cabinet in our office until they were turned over to Mr. Nelson from your office. ‘With respect to the PDA, we received the device from Mayor Adams on January 29,2009, We tuned the device over to Andy Crain of Bridge City legal the same day. Mr. Crain’s forensic imaging of the device is detailed in his declaration, also enclosed. The PDA was returned to us on February 3, 2009, at which time we placed it in our locked cabinet, The device remained in the cabinet until we turned it over to Mr. Nelson of your office on February 17, 2009. Accordingly, we can assure you that from the time thet the Mayor tumed the computers and PDA over to our office, to the time that we turned them over to you, none of the original data was deleted, altered or manipulated imany way.Garvey paReR Donna Maddux schuseRt Mavis ome Page 2 Also enclosed are the unredacted cell phone records from April 10, 2008 to February 9, 2009, labeled Adams00177-00402. The Mayor produced a redacted version of the records to The Oregonian, which 1 understand was also forwarded to you. Please let me know if you have any questions. SCK:clm Enclosures PDX_pocss20732 ssi 302DECLARATION OF ROBERT YOUNG J, Robert Young hereby declare and state as follows to the best of my knowledge and belief. ia Since 1988 I have worked as a forensic software analyst, specializing in the preservation, production and analysis of computer-based evidence. 1 also specialize in Cyber- Forensics, performing plagiarism assessment of computer software for purposes of assessing copyright infringement, software methodology and claim analysis for patent infringement, and authorship analysis for misappropriation of trade secrets. [ also specialize in Techno- Archeology, the analysis of failed software development projects (projects that fail to meet contractual requirements or that are terminated for cause pr ‘to completion), multimedia and digital video analysis, and computer-based evidence preservation, recovery, and analysis. 2, (On about January 23, 2009, [ received a call fiom lawyer Samuel C. Kauffman. ‘Mr. Kauffinan told me in essence that his firm represented Mayor Sam Adams and that Mayor ‘Adams had turned over three computers to his office. Mr. Kauffinan asked if I would create forensic mirror images of the hard drive for each computer. I told Mr. Kauffinan that I would pick up the computers the following day. On January 24, 2009, I picked up three computers from the Portland offices of Garvey Schubert Barer, Those computers are identified as follows: 4, 2. Apple Mac Book Pro Laptop, setial no. W86496RSWOG; b. Dell Dimension 3300 Desktop, identified by Dell service tag 8ZPR241; c. Dell Latitude D360 Laptop, identified by Dell service tag 2GNGBGI and City of Portland asset tag LT08913. I then took the computers back to my office, and used standard forensic procedures to create evidence images of the hard drives from each computer. For this purpose, | 303