Memory stick at centre of O’Brien’s case was altered, court told

Forensics suggest changes made to digital files subsequent to court preservation order

Denis O’Brienfailed to prove publication of Red Flag’s dossier, or that it had damaged him.  Photograph: Dara Mac Donaill

Denis O’Brienfailed to prove publication of Red Flag’s dossier, or that it had damaged him. Photograph: Dara Mac Donaill


A computer memory stick has been central to businessman Denis O’Brien’s assertions of an illegal conspiracy against him since he first went to court on October 13th, in his legal wrestling match with Red Flag Consultancy.

Initially, Mr O’Brien’s lawyers argued they wanted the High Court to give them exceptional civil search-and-seize powers so they could enter the offices of the Dublin PR firm to gather evidence with impunity.

So concerned were they, the very fact of their application to the High Court was to remain secret, lest evidence they believed existed would not be there when they arrived to seize it.

That application was refused, but the High Court subsequently ordered evidence on the memory stick and on other computer devices used by Red Flag employees was to be preserved and copied so that if it supported Mr O’Brien’s assertion, he could access it and produce it in court to argue his case.

From his point of view, by examining the computers, he would be able to drill deep into the editing history of the material on the stick: who created files, who wrote documents about him, who edited them, and for whom.

The memory stick evidence is 339 digital files, Microsoft Word documents and PDFs in the main – in 40 digital folders, all of which are contained in the memory stick, a SanDisk Cruzer Edge USB, which Mr O’Brien says was sent to him anonymously on October 8th.

Business activities

On October 16th, the court ordered the stick should be retained by Mr O’Brien’s lawyers, Eames Solicitors, pending further order and that it not be interfered with in any way, pending further order, as was reported at the time.

Much toing and froing between solicitors and forensic digital analysts acting for both sides attended the digital copying of information subsequently and both sides questioned the level of co-operation they were receiving.

Red Flag sought access to the memory stick, and on December 11th it was agreed with Mr O’Brien’s lawyers that Red Flag’s digital forensic analysts, Stroz Freidberg, could examine it and copy its contents.


“Evidence of changes to the contents of the anonymous USB stick has so far been identified on seven separate dates following the date we understand to be the date the device was produced to [Mr O’Brien’s digital experts] Espion, ” says the report.

The dates of the alterations are, according to Stroz Freidberg, October 9th, October 10th, October 12th, and October 14th – when the stick was held by Mr O’Brien’s side but prior to the High Court preservation order of October 16th. The other alteration dates, according to Stroz Freidberg, are: October 18th, October 19th and October 24th, – all subsequent to the High Court preservation order.

The report also says: “As a result of the numerous changes to and additions of data to the anonymous USB stick, key forensic artefacts may have been destroyed.

“It is also possible for some forms of modification or deletion of data to be undetectable, and the list [of dates] above may not constitute the full extent of changes to the anonymous USB stick.”

Mr Justice Colm MacEochaidh, who is hearing the case, yesterday rejected Mr O’Brien’s request that Red Flag be forced to reveal its client.

He also said Mr O’Brien had failed to prove any defamation or that he had been damaged by the contents of the memory stick.

“The one thing Mr O’Brien has not been able to prove,” said the judge, “is that anything on this dossier has hurt him.”

For a conspiracy to be proved, he added, there has to be “some evidence of motivation”.