Computer Forensics
A growing trend in investigation and litigation support is "electronic discovery." Electronic discovery is essential because the information needed to build a case increasingly resides on computer systems. In fact, far more information is retained on a computer than most people realize. It is also more difficult to completely remove information that is generally thought to have been deleted. For these reasons (among many), computer forensics can often find evidence of, or completely recover, lost or deleted information, even if it was intentionally deleted. To effectively obtain this information, you cannot simply turn the computer "ON" and start searching. Investigators need to consider issues such as spoliation, preservation of evidence and admissibility as they discover the facts.
Preservation
Will a terminated employee make a wrongful termination claim? Will you have the data in place to review the employee's old computer if the claim is made?
Data Theft Investigation
Did a former employee leave and take sensitive business information to his new company?
Was a jump drive plugged into the computer?
What CD's were burned on a computer on a particular day?
Computer Use History
How many hours a week did the plaintiff in an EEOC suit spend surfing the web?
What electronic banking activity took place on the computer?
Was the computer involved in remote desktop management?
Data/Email Recovery & Analysis
Was there a conspiracy in a contract litigation discussed in email?
When was a document first read?
A growing trend in investigation and litigation support is "electronic discovery." Electronic discovery is essential because the information needed to build a case increasingly resides on computer systems. In fact, far more information is retained on a computer than most people realize. It is also more difficult to completely remove information that is generally thought to have been deleted. For these reasons (among many), computer forensics can often find evidence of, or completely recover, lost or deleted information, even if it was intentionally deleted. To effectively obtain this information, you cannot simply turn the computer "ON" and start searching. Investigators need to consider issues such as spoliation, preservation of evidence and admissibility as they discover the facts.
Preservation
Will a terminated employee make a wrongful termination claim? Will you have the data in place to review the employee's old computer if the claim is made?
Data Theft Investigation
Did a former employee leave and take sensitive business information to his new company?
Was a jump drive plugged into the computer?
What CD's were burned on a computer on a particular day?
Computer Use History
How many hours a week did the plaintiff in an EEOC suit spend surfing the web?
What electronic banking activity took place on the computer?
Was the computer involved in remote desktop management?
Data/Email Recovery & Analysis
Was there a conspiracy in a contract litigation discussed in email?
When was a document first read?