If any form of digital information is even
remotely involved in a case or legal situation, a computer forensic examination
will be required. Digital information has invaded virtually every aspect of our
day-to-day existence, having become a basic component of our lives, from
computers, to smartphones, to social networking, digital information plays a
crucial role in almost every case.
Computer forensics differs from data
recovery, which is, recovery of data after an event affecting the physical
data, such as a hard drive crash. Computer forensics goes much further.
Computer forensics is a complete computer examination with intricate analysis
of digital information being the ultimate goal.
For a successful forensics examination, you
must have all the information relevant to a matter, not only to construct effective
legal strategies, but also to focus your expectations and efficiently budget
your services. There is nothing more difficult to address than a case which has
become complicated by new facts, where you once expected the matter to proceed
smoothly and without significant cost. Knowing all the facts early in a matter,
allows you to better prepare for those cases that will require significant
legal expertise to manage.
In response to pending litigation, analysing
your relevant ESI is an excellent way to discharge your duties to preserve
evidence and avoid spoliation, while also acquiring all relevant information
essential to your legal theories and strategies. Similarly, as part of critical
business decisions, forensically analysing relevant computers and devices can
provide essential information. For example, analysing the computers of
corporate officers or employees as part of the termination process can alert
you to possible litigation issues such as violation of non-compete agreements,
improper copying of intellectual property, etc.
To prepare for litigation, an attorney
ought to determine whether a Request for Production of Documents will obtain
all relevant evidence. A simple question to ask is whether you want to discover
part of the relevant information (i.e. visible by your opponent’s operating
system) or all of it (deleted, hidden, orphaned data, etc). It is not
unrealistic to anticipate that information contained on a computer system which
is helpful to a matter would be saved, while that which is harmful would be
deleted, hidden, or rendered invisible. For example, in sexual harassment
cases, it is not unusual to discover deleted emails and other data invisible to
the operating system that significantly impacts the case. Computer forensic
analysis extracts all the emails, memos, and other data that can be viewed with
the operating system, as well as all invisible data. In many cases, the
invisible data completely changes the nature of a claim or defense, often
leading to early settlement and avoiding surprises during litigation.
In any situation in which one or more
computers may have been used in an inappropriate manner, it is essential to
call a forensic expert. Only a computer forensic analyst will be able to
preserve, extract, and analyze the vital data that records the “tracks” left
behind by inappropriate use. Taking the wrong steps in these circumstances can
irrevocably destroy the vestiges of wrongful use that may result in litigation
or criminal prosecution.
Digital, computer and mobile forensics requires much more than what you may think. At DLA, our seasoned investigators use a special set of skills and tools to recover or find the digital data that you need!
