At the request of an attorney representing the defendants in a civil lawsuit connected to the Eureka Springs City Advertising and Promotion Commission, a digital forensics firm collected computers and other electronic devices from the CAPC office for examination in November 2021.
Technicians from Avansic eDiscovery + Digital Services collected a total of 39 devices from the CAPC office then located at 122 E. Van Buren, Suite 3, and from the Eureka Springs Auditorium on Nov. 4, 2021, according to copies of email communications between Avansic representatives and attorney Amanda LaFever of the Arkansas Municipal League.
The Lovely County Citizen obtained copies of the email correspondence through an open-records request to LaFever, who represents the defendants in the lawsuit filed in Carroll County Circuit Court by Eureka Springs attorney Tim Parker in March 2021.
Plaintiffs in the suit are former CAPC events coordinator Tracy Johnson, former finance director Rick Bright, former interim director Gina Rambo, former group sales coordinator Karen Pryor and former commissioner Greg Moon.
Bright and Pryor were still employed by the CAPC when the suit was filed but both later left their positions. Rambo was demoted from the interim director position and later fired in February 2021. Carroll County Circuit Judge Scott Jackson ruled later in 2021 that the commission had no authority to vacate Moon’s seat, as it had done in January 2021, and he rejoined the commission but later resigned. Defendants in the suit are Mayor Butch Berry Berry; CAPC commissioners Patrick Burnett, Jeff Carter and Carol Wright; city council members Melissa Greene and Harry Meyer, both of whom were CAPC commissioners at the time the suit was filed; Kim Stryker, Berry’s administrative assistant; former CAPC commissioner James DeVito; former CAPC executive director Lacey Ekberg; the city; and an insurance company that provides a policy to the city. A second insurance company was originally named as a defendant but was later dismissed from the suit.
LaFever originally spoke with Brad Deavers, a project manager for Avansic on May 10, 2021, emails show. Based in Tulsa, Avansic describes itself as “a leading provider of eDiscovery and digital forensics services to attorneys, litigation support teams, and business communities across the nation.”
On May 11, 2021,Avansic sent an engagement letter and a copy of its standard terms and conditions to LaFever. The standard schedule of fees outlined in that document includes $250 an hour plus destination media for onsite data preservation and collection
EIN Custodians Comment 1 Pryor, Karen Lenovo Thinkcentre M900Z all-in-one. SN: MG 220GX5
001A Pryor, Karen Seagate Laptop Thin HDD. SN: W62D19LA. Hard drive of 001
2 Bardin, Scott Lenovo Thinkcentre M900Z. SN: MG 220GX7
002A Bardin, Scott Seagate Laptop Thin HDD. SN: W62D3GFG. Hard drive of 002
3 Dell Inspiron 15. SN:9RT8932
4 Apple Powerbook G4 17 in. Model: A1107. SN: W8515352RJ3
004A Seagate HDD 100GB. SN: 3LG0NESL. Hard drive for 004, was damaged; could not image.
5 Apple Powerbook G4 17 in. Model: A1013. SN: V731618DMVZ
005A Fujitsu HDD 60GB. SN: NL24T4BMLCA8, Hard drive for 005.
6 Apple Macbook Pro. Model: A1706. SN: C02VD1MMGTFJ
7 iPad. Model: A1822. SN: GCGVF7J3HLF9. Factory Rest – No reason to image.
8 Rambo, Gina iPad. Model: A2228. SN: DMPDT15BPTRF. Factory Rest – No reason to image.
9 iPad. Model: A1822. SN:GCHV53B5HLF9. Has ‘AUD IPAD #1’ sticker on the back.
10 iPad. Model: A1566. SN: DMPS2Z8CG5VJ. ‘AUD IPAD #3’ sticker on back.
11 iPad. Model: A1822. SN: GCGVF6A5HLF9
12 iPad. Model: A1395. SN: DN6FQ8IEDFHY. ‘#2 tickets’ sticker on back. Factory Rest – No reason to image.
13 Dell Latitude E5500. SN: 5S2MXG1
013A Fujitsu 120GB HHD. SN: K321T8125YRB. Hard drive for 013.
14 RCA tablet. Model: W101SA23. Would not power on. No SN on outside.
15 RCA tablet. Model: W101SA23. Black Scuff on top. Would not power on. No SN on outside.
16 iPad Air 2. SN: DMPS2Z8CG5VJ
17 iPad Air 2. SN: GCGV5MCRHLF9.
18 iPad. Model: A1460. SN: DMQJMH6018W. Did not have correct passcode for. Unable to image.
19 iPhone 5c pink/salmon color. Model: A1532. SN: C7JMG5PGFNDJ
20 iPhone with black leather case. Model: A1303. Would not turn on. Could NOT image.
21 Pryor, Karen iPhone. Black. Model: A1349. SN: C8RGT5LFDP0V
22 Gateway PC. SN: PTGCPP20031410174D6300
23 Dell PC. SN: 3THYT61
023A Hitachi Deskstar. SN: VN6B7PCBESG03C. Hard drive for 023.
24 Lenovo Thinkserver. SN: MJYHMK8
024A WD 500GB. SN: WCAWFD611224. Hard drive for 024.
024B Seagate HDD. SN: 9WJ1CESF. Hard drive for 024.
25 Dell PC. SN: 58ZDNL1
025A Samsung HDD 160GB. SN: S1VCJ90SC61405. Hard drive for 025.
26 ThinkCentre Desktop. SN: 0870A6UMJATEDW
026A Seagate 500 GB. SN: 5VMYRXYL. Hard drive for 026.
026B WD 1 TB HDD. SN: WD-WCAV5V906033. Hard drive for 026.
27 Bright, Rick iPad in red case. Model: A1822. SN: GCVV8ZDFHLF9. Factory Rest – No reason to image.
An inventory of electronic devices reviewed by the forensic auditing firm Avansic eDiscovery + Digital Services at the request of an attorney representing the defendants in a civil lawsuit connected to the Eureka Springs City Advertising and Promotion Commission.
or remote collection, $600 per device and $300 an hour for forensics processing and investigation, $450 to $1,500 per device for cell phone forensics and $25 per drive unit per month and $114 per original media per month for storage.
In an email sent to Deavers and Avansic project manager Meredith Lee on July 20, 2021, LaFever’s paralegal, Jessica Pacheco, writes: “We had a call with Meredith detailing what we wanted and needed and I’ve sent her all of the information we received from the commissioners regarding the suspicious activity they have encountered. What are the next steps and/or what do you need from us?”
Carroll County Newspapers has requested a copy of the information sent from Pacheco to Lee pursuant to the Arkansas Freedom of Information Act.
On Oct. 27, 2021, Pacheco emailed Deavers regarding the CAPC’s planned relocation of its offices to theAuditorium.
“Our clients are in the process of moving offices, which has put pressure on the deadline to have the computers copied,” Pacheco’s email says. “We need someone to go to the offices in Eureka Springs to copy the computers on or before November 5th. Only one Plaintiff in the case remains on staff. We can arrange for her to be out of the office on the date scheduled.”
Pacheco was apparently referring to Pryor, the only one of the plaintiffs to still be employed or contracted by the CAPC at that time.
Deavers replied to Pacheco’s email later that day.
“Jessica, this is something we could plan on doing late next week i believe, but i need to verify with my lab techs,” Deavers’ email says.
“I do need to confirm number, type, make and model of the devices we anticipate collecting to get this scheduled.
“I have notes from a call in July and have the following devices for potential collection: “1. Rick computer “2. Gina computer “3. Karen iPad “4. Karen iPhone “5. Tracy computer “6. ‘former user’ computer (not sure who this is) “7. ‘former user’ computer (not sure who this is) “Can someone in the office confirm these, and provide make and model of the computers? Are there any other devices?”
Pacheco responded on Oct. 29, writing: “This is the list I was sent. Please let me know if you need any additional information regarding the devices.”
Deavers answered later that day, listing a total of 22 devices, including four that he highlighted in yellow.
“See the highlighted items, I would guess that those might be servers with multiple hard drives within each,” Deavers writes. “We need to verify number of hard drives within each of these.”
Deavers goes on to mention the potential cost of examining the devices.
“Second, and more important, I suggest we verify that all the items in this list may contain potentially relevant data.” Deavers writes. “I think this is important for two reasons; first, from the descriptions some of these items look to be older legacy devices that may not actually have data relevant to litigation (not sure), but second, imaging all these devices will take a substantial amount of time and expense. I would say to do all these devices would need two techs onsite for 3-4 days total, estimating total cost between $25,000 and $30,000. Happy to do this work, but I want to be up front on cost. I think we need to make sure all the items in this list are relevant.”
In a Nov. 1, 2021, email to Pacheco and LaFever, Deavers writes: “Checking back if any updates or confirmation of devices on your end. If we do need to plan to image all 23 devices in below list, we would like to plan to start work Wednesday. If we do need to plan for Wednesday we would like confirmation back today or early tomorrow and a call with our onsite contact to plan logistics and office operations while we are on site.”
LaFever replied later that day, writing: “Per our conversation, the items that need to be imaged on-sight are one “all-in-one” computer that is located at 121 E. Van Buren #3, Eureka Springs, Arkansas 72632, one ‘all-in-one’ computer than is located at the Auditorium, and two iPads that are located at the Auditorium. All the other items that are being taken for on-sight imaging are located at the Auditorium.
“Madison Dawson, the CAPC Tourism Director, will meet your technician at the 121 E. Van Buren #3 location on Thursday, November 3, 2021, at 10:00 a.m. to facilitate the on-sight imaging of the one computer, and then once the on-sight imaging of the computer located on Van Buren is complete, Madison will direct the technician to the Auditorium for the remaining on-sight imaging and to pick up the other items.”
Deavers confirmed the schedule later that day.
“Thanks so much for this,” he writes. “We are good to go with this. My tech will meet Madison at the Van Buren offices 10AM Thursday.”
Deavers emailed LaFever and Pacheco with an update on Nov. 10, 2021.
“Amanda and Jessica, reporting back on the work,” Deavers writes. “We anticipate finishing imaging today or tomorrow. I will report back and schedule drop off of the devices back to CAPC for tomorrow of Friday.”
Avansic’s techs were unable to log into one iPad, Deavers writes.
“If it helps to identify, this iPad has a lock screen photo of the ‘Welcome to Eureka Springs’ sign and the Apple ID is ‘karen@eurekasprings.org,’ he writes.
Deavers goes on to list the various passwords that techs have tried in an effort to log into the device.
“We also tried to call Molly and Madison but neither answered,” he writes, apparently referring to Dawson and CAPC marketing director Molly Horton.
On Nov. 11, 2021, Deavers emailed LaFever and Pacheco again.
“Amanda and Jessica, we have completed all the imaging that we can,” he writes. “Please see attached list of all evidence items. There were a number of items that we were not able to image, highlighted yellow. Some were factory reset (and would contain no user created data), some would not power on, some were damaged, and we also had the iPad from below that we had no password for. At this point, unless we take extra ordinary steps to try and solve some of the issues we had (which likely would not help), I believe we are done. Let me know if you agree and if we should schedule return of the devices tomorrow. I assume we should return everything to the auditorium, let me know if not. I would suggest we arrive about 10AM if staff is fine with that.”
The list attached to Deavers’ email included 38 devices and hard drives.
