Replies to post #297014 on Mr Cooper Group Inc (COOP)

[sidedraft]

A&M may be trying verify that there were never any emails between Kevin Starke and members of their team, BR perhaps?

[joe513]

It would appear they had to fire an employee and are checking to see what that employee had been up to. Happens in every company. You just don't know about it because regular companies don't have to document what their IT department is up to for the whole world to see.

[argc]

Wow.this is really interesting,they are not wiping out stuff in computer,they tried to restore some deleted ITem such as Browse History, Cache, Deleted Email ,also including the record of visiting the WAMU related online forum..
Seems they are collecting evidence of some employee unauthroized action, such as posting online or leaking news.Not sure it's good or bad but very interesting.

[fsshon]

This is most likely Nate Thoma's information. The Debtors wanted to try and prove Nate had been in prior contact with the EC members before he submitted his objection to confirmation in Nov 2010. Before they could make sure Nate was for real, they had to clear him.

He told Appaloosa I got it off the internet, do you know how to use a search engine? No F* off!

Notice the date, it corresponds with the Appal;oosa withdrawl. Mr. Tepper we did not find anything of revelance on Mr. Thoma's Laptop
We tried! It is recommended you withdraw you motion to compel.
Sincerely
John Maciel

[SlyOne]

WTF?

These idiots cant tell the difference between POP3 and WEBMail systems. THere will be no record of emails unless POP3.

Dont think this is thoma issue. Re: the word "internal."

IMO: AM wondering if employee leaked info to forums
Or, employee monitioring forums. My leaning is former.
Some forums got info. Maybe ghost, Ihub or Y or United.

Someone at AM is feeling guilty.

FY Kurtosos

[backtrax]

Betcha they get a Keystroke logger for their network ASAP, if this was in regaurds to an employee.

[mattchew]

Someone who was trading on IT. Like where is JW? he last posted in March and this is from April billing!



Who or what do ya suppose they are after?
From Alvarez and Marsal billing:
Washington Mutual, inc. (83432)
Time Summary
Johnson
DAF
Day Date Time Rate Billings
Tuss 4/2Q/2011 15.50 S 455 $ 7,052.50
Wed 4/27/2011 9.50 455 4,322.50
Thur 4/28/2011 4.25 455 1,933.75
Fri 4/29/2011 3.75 455 1,706.25
Sat 4/30/2011 0.75 455 341.25
33.75 S 15,356.25
Description
Forensic Imaging of internal laptop. Verifying image from interna! laptop. Completing documentation
associated wiih internal forensic image. Beginning keyword analysis of image as per request.
Extraction of email PST containers to be uploaded to lab for processing through keyword searching.
Preliminary analysis of forensic image with respect to file wiping software. Working with team to create
search terms and search criteria.
Generating deleted file report Reviewing forensic image for evidence of wiping software; beginning
internet history report generation.
Analysis of forensic image; USB device analysis; review of deletion activity; continuing internet history
report generation.
Continuing internet history report generation, and reviewing history for evidence of any visits to
specific forums related to Wamu.