Expert spent 'long time' on files

22:54, Mar 26 2014

A forensic computer expert could have carried out up to six other inquiries in the time he spent investigating the massive amounts of computer files downloaded by a former Tag Oil manager.

Canadian, James Winston Watchorn, 42, a former production manager for New Plymouth-based Tag Oil (NZ) Ltd, denies three counts of dishonestly accessing the exploration and production company's computer on June 7, 2012.

Crown solicitor Cherie Clarke alleges Watchorn downloaded a huge number of files on to his personal harddrive prior to leaving Tag Oil to go to his new job with the company's competitor New Zealand Energy Corp.

Many of the files included sensitive seismic information Watchorn had no dealings with in his job, she said.

Police electronic crime lab expert Ian Donovan spent most of the day giving evidence about his analysis of data on Watchorn's Del computer seized from his work station at NZEC in August 2011, his personal harddrive, USB and a home laptop.

On June 7 two folders were set up and large amounts of data from the Tag computer were downloaded into them, Mr Donovan said.


The files had been downloaded in quick succession.

There was criticism how long the forensic analysis had taken but there were a huge number of files to look at, he said.

In Watchorn's LaCie harddrive there were files of 931GB and 134GB in a Tag backup folder containing 124,670 files.

Some were later deleted but others kept.

To defence counsel Susan Hughes QC, Mr Donovan could not tell Ms Hughes how many hours he had spent on the investigation.

Because of the "sheer number of files" involved he could have done another five or six jobs in the time spent, Mr Donovan said.

He agreed he found no evidence her client copied or transmitted any data to a third party after the download took place. However he said this might have happened.

Mr Donovan said it was possible the LaCie harddrive was used in another computer in Canada that he didn't have access to in order to check.

Ms Hughes asked if Mr Donovan was aware that when the police returned the LaCie harddrive it still contained all of the Tag information.

Mr Donovan said he was not privy to that information.

Ms Hughes said her client was in the habit of making bulk untargetted downloads.

"In my view creating two folders is a targeted approach," Mr Donovan replied.

One of Watchorn's former work colleagues, Carey Davis, has told the court he estimated "very key data", some of which outlined the company's "secret recipes" to find oil and gas - could be worth as much as $50-$100m to a competitor.

While interviewing Watchorn on August 28, 2011, Detective Byron Reid told him he was arrested that day for "obtaining trade secrets".

The interview, recorded on DVD, was played to the court yesterday afternoon.

The detective told Watchorn the allegation made by his former employer, Tag Oil through their Auckland lawyers, was that he had transferred Tag Oil's electronic data on to his own harddrive.

The information included geological and drilling data used by the company to find oil and gas.

There were concerns this information was still in his possession or could have been with another company, Mr Reid said.

Watchorn said he had a technical role with Tag and had his own data, which he developed over 20 years, on his personal laptop.

On the day he resigned he had been asked to leave the same day rather than work out his two weeks' notice.

As a result he "inadvertently" dragged and dropped the operations file on to his computer's harddrive because he was in a "bit of a rush".

He said he was asked by the chief executive Edward (Drew) Cadenhead to pass over the information a couple of days after he had resigned.

Because the information was on his personal computer, Watchorn asked the chief executive for them to have a coffee together so they could decide "how to proceed".

"And that's where it's been left," Watchorn said.

Mr Reid said with Watchorn's departure to NZEC there were real concerns the sensitive information had gone to his new employer. "Absolutely not," Watchorn replied.

Mr Watchorn said he was more than willing to turn over the data.

Mr Reid said that had needed to be addressed at the time.

The chief executive only found out the directory had been cloned when he returned from overseas.

"Obviously with the information downloaded from the directory was cause for lawyer to come to police.

"You had no need to have access to this information because it was out of your realm," Mr Reid said.

The interview was suspended when NZEC's lawyer, Ms Hughes QC arrived at the police station and asked to speak to Watchorn.

The judge-only trial before Judge Allan Roberts continues today.

Taranaki Daily News