VirtuSky

Computer forensics has become an effective and necessary tool in the investigation of many types of litigation and human resource matters. With the steady growth of computer based storage, communication and access, more and more of what we do is digitally recorded and tracked for future review.

A thorough forensic review of computer data can often reveal the crucial information that allows you to make critical decisions, prepare effective litigation pleadings, and ultimately reach conclusions favorable to your interests.

Computer forensics is generally described as the determination of what occurred on a computer or device, who participated in the occurrences, when the occurrences happened, what other actions were taken during the same period and what was done to conceal or delete the actions on the machine.

Computer forensics can be critical in the following types of investigations:

• Theft, misuse or transfer of intellectual property
• Web browsing activity
• Email communications
• Spoliation
• Improper use of time/resources
• Employee misconduct
• Violations of non-compete or non-solicit agreements

• Fraud
• Breaches of fiduciary duties and embezzlement
• Violations of other court orders
• Alteration of data
• Cloud data storage
• Medical malpractice
• Harassment
• Internet issues

Pre-Planning

Engaging a computer forensics expert early on in your matter will allow the expert to assist you in determining relevant sources of Electronically Stored Information (“ESI”) to be collected. Pre-planning also allows the expert to assist you in thoroughly forming protective orders and interrogatories to reduce the amount of time spent going back and forth with the other party or parties. Additionally, during this phase, adequate preservation letters can be drafted to ensure relevant data is available for collection.

Collection

The forensic collection of data utilizes specific, court approved and verifiable tools and methods for acquiring and collecting ESI, guarding against an inadmissibility ruling or a challenge of validity. For these reasons, it is recommended to not use a party’s in-house I.T. worker to collect ESI. Collections can be done on-site or at the Expert’s facility.

Analysis

Depending on your specific needs as determined in the pre-planning phase, analysis may be as simple as reporting on deleted files or as complicated as determining which office workers copied specific files to removable drives or emailed client lists to their personal email addresses. Analysis is often a multi- step process as newly discovered data invariably leads to new searches. A well defined end goal helps clearly define this analysis and keep costs in check.

Reporting

Findings from the analysis phase are only of use if they are communicated in a clear, concise and manageable format that you as the end user can apply to your efforts. Whether the report is a detailed expert report for the court, an affidavit, a detail of findings for your incorporation into a document or simply a memorandum of findings, information must be presented to you in a manner that is applicable, usable and professional.

Testimony

Be it to Judge, Jury or Arbiter, expert testimony can make or break your case. The expert must not only be able to effectively convey his findings, but do so in a manner that convinces the court or jury of his credibility. Ensure that your expert has both the technical knowledge to report his findings as well as the experience level to present those findings to the court or jury. Many “tech” people are very good at what they do, but without hundreds of hours of testimonial experience, they may not be able to effectively communicate their findings. This is further reason to use a qualified computer forensic expert rather than in house personnel or I.T. Staff.