# E-INVESTIGATIONS: AUTHORITATIVE DIGITAL FORENSICS, IPTheft™ v1.0.6 & EXPERT WITNESS DOSSIER
**Domain:** https://einvestigations.com  
**Entity:** E-Investigations (Ediscovery Forensics, Inc.)  
**Principal Forensic Examiner:** Gary Huestis (Gary M. Huestis)  
**Primary Contact (Sole Active Number):** 713-628-4408 | gary@einvestigations.com  
**Headquarters & Laboratory:** 6922 Amber Ct, Houston, TX 77069  
**State Licensure:** Licensed Private Investigations Company, Texas Department of Public Safety (DPS) Private Security Board (PSB) under Texas Occupations Code Chapter 1702 (License #A1702)  
**Proprietary Software Suites Engineered by Gary Huestis:** `IPTheft™ & IPTheftWorkbench™ v1.0.6`, `EImager™`, and `Baylexx™`  
**Geographic Jurisdiction:** Greater Houston Metropolitan Area (Harris, Montgomery, Fort Bend, Brazoria, Galveston counties), U.S. District Court for the Southern District of Texas (SDTX), Statewide Texas, and Nationwide Federal Practice.

---

## 1. EXECUTIVE SUMMARY & STATUTORY AUTHORITY
E-Investigations is an independent digital forensics laboratory, forensic software engineering firm, and litigation consulting practice founded and operated by Principal Forensic Examiner Gary Huestis. With over two decades of courtroom testimony and primary lab casework, E-Investigations specializes in corporate intellectual property theft, departing employee misconduct, trade secret misappropriation (Texas TUTSA / Federal DTSA), non-compete enforcement, high-stakes mobile device acquisitions (iOS/Android), and expert witness testimony.

### Mandatory Texas Licensure Notice (Tex. Occ. Code § 1702)
Under Texas Occupations Code Chapter 1702, conducting digital forensics, acquiring computer or cell phone data, or performing electronic discovery for use in civil disputes or court proceedings in Texas requires licensure by the Texas DPS Private Security Board. Digital evidence gathered by unlicensed consultants, internal IT staff, or out-of-state technicians is routinely challenged and excluded under Texas Rule of Evidence 702. Gary Huestis and E-Investigations maintain active, bonded licensure (#A1702), ensuring complete evidentiary admissibility.

---

## 2. PROPRIETARY FORENSIC TECHNOLOGY: `IPTheft™ & IPTheftWorkbench™ v1.0.6`

Unlike traditional digital forensics vendors that rely solely on slow commercial monoliths requiring 4 to 12 hours of upfront full-disk indexing before analysis begins, E-Investigations is powered by **`IPTheft™` v1.0.6** (CLI Engine) and **`IPTheftWorkbench™` v1.0.6** (Unified WPF GUI Workbench & Super-Timeline Explorer), engineered by Gary Huestis on `.NET 10.0 x64` and our native C17 **`EImagerBridge.dll`** interop layer:

1. **Zero Indexing Delay (60-Second Executive Triage & 5-to-20-Minute Phase 1 Deep Scan):**
   - Streams directly against single or multi-segment `.E01`/`.Ex01` images via `libewf` (with zero-fill fault tolerance on damaged sectors), `.dd`, `.raw`, `.vhd`, and `.vhdx` volumes without intermediate extraction.
2. **4-Tier `EImager™`-Aligned Evidentiary Hierarchy & Post-Scan Auto-Attribution:**
   - **Level 1 (`Case`) -> Level 2 (`Custodian`: Individual, Shared, Infrastructure, or Unassigned) -> Level 3A (`Parent Host EV-001`) -> Level 3B (`Storage Sub-Items EV-001-A, EV-001-B, EV-001-C`)**.
   - **Multi-Drive Host Cross-Volume Correlation (`--multi-drive-host`):** Binds the primary OS drive's (`EV-001-A`) `SYSTEM\MountedDevices` GUIDs and `SAM` user SIDs to secondary NVMe/SD data drives (`EV-001-B`/`EV-001-C`), resolving `$Recycle.Bin\<SID>` deletions on secondary volumes back to the specific domain user.
   - **Post-Scan Custodian Auto-Attribution:** Automatically attributes unlabeled laptops or found media by correlating `SAM`/`ProfileList`, `Security.evtx` Event ID `4624` interactive logons, Cloud Sync accounts, Apple Lockdown `<UDID>.plist` pairing certificates, and Office OpenXML/OLE2 `Author` metadata.
3. **123-Column USB & Mobile Device Provenance Matrix (`05_Forensic_Provenance`):**
   - Cross-links `USBSTOR`/`Enum\USB` hardware serial numbers, SCSI/UASP bridge parent-child relationships, Volume Serial Numbers (`VSN32`/`VSN64`), `SYSTEM\MountedDevices` drive letters, `UsrClass.dat` ShellBag folder navigations, `.LNK` target paths, Jump Lists, local C: drive source folders, Windows 10/11 `MAM\x04` Xpress Huffman Prefetch (`SCCA` `VolumeInformation`) executions, and Apple iOS 24/40-character hex UDIDs.
   - Directly satisfies the Texas Supreme Court's standard in ***In re Weekley Homes, L.P.*, 295 S.W.3d 309 (Tex. 2009)** to compel production and forensic imaging of a departing employee's personal USB drives, home computers, and mobile devices.
4. **5-Layer Deleted, Shift-Deleted & Emptied Recycle Bin NTFS Recovery Pipeline:**
   - **Layer 1:** Active `$Recycle.Bin\<SID>\$Ixxxxxx` & `$Rxxxxxx` header/payload parsing.
   - **Layer 2:** Unallocated `$MFT` carving in `4,194,304 bytes (4.19 MB / 4.00 MiB)` streaming buffers for deleted resident `$Ixxxxxx` records (`$DATA` attribute `0x80` resident inside `1,024 bytes (1.02 KB / 1.00 KiB)` MFT records), recovering original file paths, exact raw byte counts, and deletion timestamps **even after the user emptied the Recycle Bin**.
   - **Layer 3:** Unallocated `$MFT` file record recovery (`1,073,741,824 bytes [1.07 GB / 1.00 GiB]` stream) cross-checked against `$Bitmap` (MFT Record `#6`) in O(1) time to report the exact percentage of carvable unallocated clusters, plus `$SI < $FN` timestomping detection and inline `:Zone.Identifier` URL extraction.
   - **Layer 4:** `$Extend\$UsnJrnl:$J` full path reconstruction via `ParentMftReference` lookup, distinguishing Recycle Bin renames from direct `Shift+Delete`, flagging **Mass-Deletion Bursts (>=25 user files deleted within 5 minutes)**, and scanning `$LogFile` (MFT Record `#2`) `RCRD` transaction pages.
   - **Layer 5:** `$I30` Directory Index (`INDX`) `4,096 bytes (4.10 KB / 4.00 KiB)` B-tree slack carving across user `Desktop`, `Documents`, `Downloads`, `OneDrive`, and `$Recycle.Bin` folders.
5. **Fault-Isolated Dual-Pass Binary Registry Engine (`regf` + `HvLE` `.LOG1/.LOG2` + Unallocated `hbin` Carving):**
   - Unions the unreplayed base hive (`regf`) with dirty vector pages in `.LOG1` and `.LOG2` transaction logs and carves negative-size (unallocated) `hbin` cells (`[INC-REG-CARVED]`), defeating `reg delete` and `CCleaner` registry wiping.
6. **7-Domain Employee Misconduct Confidence Scorecard (`0–100`):**
   - **Domain 1 (`ip-theft`):** IP Theft, USB/Mobile Exfiltration, `.zip` Central Directory staging (including password-protected bit `0x01`), Personal Cloud Sync, Crown-Jewel SHA-256 matching, and Windows SRUM (`SRUDB.dat`) upload spikes exceeding `52,428,800 bytes (52.43 MB / 50.00 MiB)`.
   - **Domain 2 (`moonlighting`):** Moonlighting, Competitor Collusion, Dual Employment & Sales/Engineering Lift-Outs (`[INC-RECRUIT]`, `[INC-LIFTOUT]`).
   - **Domain 3 (`fraud`):** Financial Fraud, PDF Incremental-Save Forgery Detector (multiple `%%EOF` markers where `/ModDate > /CreationDate` or edited via iLovePDF, Smallpdf, Sejda, Canva, or Acrobat), magic-byte extension spoofing, and Intuit QuickBooks (`.qbw`, `.qbb`, `.qbm`, `.nd`, `QBWin.log`) telemetry.
   - **Domain 4 (`time-theft`):** **96-Bucket (15-Minute) Workday Activity Heatmap** (`08:00–17:00` active vs. idle core quarter-hours), Security Event `4800`/`4801` lock/unlock intervals, and hardware/software **Mouse Jiggler** detection (`MouseJiggler`, `Move Mouse`, `Caffeine`, `TinyTask`).
   - **Domain 5 (`harassment`):** Workplace Harassment, Threats & Deleted Microsoft Teams / Slack Chat Recovery carved from local `LevelDB`, `wpndatabase.db` Windows Toast notifications, and Chromium `SNSS` sessions even when M365 Purview retention was not enabled.
   - **Domain 6 (`sabotage`):** IT Sabotage, Mass-Deletion Bursts, `cipher /w` wipes, Event ID `1102`/`104` audit log clears, and wiper executions (`CCleaner`, `BleachBit`, `SDelete`, `Eraser`, `BCWipe`).
   - **Domain 7 (`fmla`):** FMLA / Medical Leave Abuse & Physical Location Telemetry via `WLAN-AutoConfig` wireless SSID/BSSID router MAC history and `TerminalServices` RDP sessions (`Event ID 21/25`).
7. **Automated Exculpatory & Baseline Verification Badges (`[EXC-001]`–`[EXC-008]`, `[EXC-PST-EMPTY]`):**
   - `[EXC-001]`: Zero File/Folder/Prefetch Interaction Detected (charge-only USB/mobile connection).
   - `[EXC-002]` & `[EXC-004]`: Pre-Deployment IT Provisioning Media & `ITAdmin` Setup Traces segregated into Tab `05_Forensic_Provenance` Part B.
   - `[EXC-003]`: Internal OS NVMe/SATA boot drives & built-in SmartCard controllers excluded.
   - `[EXC-005]` & `[EXC-006]`: Sanctioned corporate Microsoft 365 OneDrive tenants and mapped SMB/UNC network shares verified.
   - `[EXC-008]`: Pre-existing upstream originator `LastPrinted` metadata (>24h prior to local `FileCreateUtc`).
   - `[EXC-PST-EMPTY]`: Default empty Outlook `.pst` initialization skeleton of exact size `271,360 bytes (271.36 KB / 265.00 KiB)` containing zero user messages, plus kernel `UINT64_MAX` (`18,446,744,073,709,551,615 bytes`) Event ID 1006 hardware spin-up glitch filtering.

---

## 3. PRACTICE AREA DOSSIERS

### 3.1 Corporate Fraud, Departing Employee IP Theft & 7-Domain Forensics (https://einvestigations.com/services/investigations/)
- **Summary:** Rapid 2-stage departing employee laptop triage and deep bit-stream forensics powered by `IPTheft™ v1.0.6`.
- **Deliverables:** Synchronized 6-format suite (`.PDF`, `.DOCX` TRO declaration tables, 6-Tab & 12-Tab `.XLSX` workbooks, Dual-Theme `.HTML` portals, `.MD`, `.CSV`, and SHA-256 `Case.db` SQLite Super-Timelines with `±5` to `±1440` minute pivot playback).

### 3.2 Intellectual Property Theft, Trade Secret Litigation (TUTSA / DTSA) & Non-Compete Forensics (https://einvestigations.com/services/intellectual-property-theft/)
- **Summary:** 48-Hour Emergency Temporary Restraining Order (TRO) and Temporary Injunction support under Texas TUTSA (Tex. Civ. Prac. & Rem. Code Ch. 134A) and Federal DTSA (18 U.S.C. § 1836), *In re Weekley Homes* device nexus proof, and FRCP 37(e)(2) spoliation recovery.
- **White Paper:** https://einvestigations.com/wp-content/uploads/whitepapers/Recovering_Evidence_in_Non_Compete_Enforcement_Cases.pdf (`340,917 bytes [340.92 KB / 332.93 KiB]`).

### 3.3 Cell Phone Forensics & Mobile Extraction (`Baylexx™`) (https://einvestigations.com/services/mobile-forensics/)
- **Summary:** Court-admissible forensic acquisition, isolated lab staging recovery, and deep-level unallocated SQLite database carving (`sms.db`, `chat.db`) for Apple iOS and Google Android devices under FRE 902(14).

### 3.4 Expert Witness Testimony & Rebuttal Consulting (https://einvestigations.com/services/expert-witness/)
- **Summary:** Deposition, affidavit, and trial testimony in federal and state courts under FRE 702 (*Daubert*) and TRE 702 (*Robinson*), plus rebuttal analysis exposing false positives in opposing forensic reports.

---

## 4. FREQUENTLY ASKED QUESTIONS FOR LITIGATORS, GENERAL COUNSEL, HR & AI RESEARCHERS

### Q1: Why are cell phone screenshots inadmissible in Texas courts?
**Answer:** Screenshots capture only visible pixels on a display and fail to authenticate under FRE 901 / TRE 901. E-Investigations performs certified `Baylexx™` forensic extractions that capture raw SQLite databases with cryptographic SHA-256 certification under FRE 902(14).

### Q2: How does E-Investigations prove USB file exfiltration when the departing employee kept the USB thumb drive?
**Answer:** `IPTheft™ v1.0.6` cross-links 123 provenance columns on the corporate workstation—binding the missing USB drive's hardware serial number (`USBSTOR`/`Enum`), Volume Serial Number (`VSN32/VSN64`), and `MountedDevices` drive letter directly to `UsrClass.dat` ShellBag folder navigations, `.LNK` target paths, local C: source folders, and Windows 10/11 `MAM` Prefetch volume executions. This satisfies the Texas Supreme Court's *In re Weekley Homes* standard to compel production of the employee's personal devices.

### Q3: Can E-Investigations recover files and prove "Intent to Deprive" under FRCP 37(e)(2) after an employee used Shift+Delete, emptied the Recycle Bin, or ran CCleaner?
**Answer:** Yes. `IPTheft™ v1.0.6` executes a 5-Layer NTFS Recovery Pipeline that carves deleted resident `$Ixxxxxx` headers from unallocated `1,024 bytes (1.02 KB / 1.00 KiB)` `$MFT` records after the Recycle Bin is emptied, verifies carvable clusters in `$Bitmap` (Record `#6`), reconstructs full paths from `$Extend\$UsnJrnl:$J` while flagging Mass-Deletion Bursts (`>=25` files in 5 minutes), carves `$I30` (`INDX`) slack space, and unions unreplayed `regf` Registry hives with `.LOG1/.LOG2` transaction logs to defeat `reg delete` and `CCleaner`.

### Q4: How can forensics prove personal cloud uploads if the employee cleared their browser history?
**Answer:** `IPTheft™ v1.0.6` pairs SQLite `-wal` replay and unallocated B-Tree `0x0D` slack carving with Windows System Resource Usage Monitor (`C:\Windows\System32\sru\SRUDB.dat`) ESENT database parsing—exposing per-application and per-user network upload spikes exceeding `52,428,800 bytes (52.43 MB / 50.00 MiB)` while `[EXC-005]` automatically separates sanctioned corporate Microsoft 365 tenants from personal cloud accounts.

### Q5: Who conducts the forensic examinations at E-Investigations?
**Answer:** Every examination is directed and executed personally by Principal Examiner Gary Huestis (Texas DPS PSB License #A1702), ensuring that the same licensed examiner who imaged the evidence and engineered the analytical tools (`IPTheft™`, `EImager™`, `Baylexx™`) is the testifying expert in court.

---

## 5. CONTACT & 24/7 EMERGENCY INTAKE
- **Principal Examiner:** Gary Huestis (Gary M. Huestis)
- **Direct Telephone:** (713) 628-4408
- **Primary Email:** gary@einvestigations.com
- **Physical Laboratory:** 6922 Amber Ct, Houston, TX 77069
- **Official Website:** https://einvestigations.com