Forensic Investigations and E-Discovery

Forensic Discoveries provides the ability to search and analyze various pieces of potential evidence of electronic nature. Evidence items can involve computer hard drives, portable storage, floppy diskettes, portable music players, and personal digital assistants (PDAs) just to name a few. All aspects of evidence will be verified, and then duplicated prior to any investigation to ensure the integrity of the evidence for litigation purposes if needed.

Computer evidence can oftentimes be the deciding factor in a criminal, civil, or employee dismissal action. Investigations involving trade secrets, commercial disputes, misdemeanor, and felony crimes can be won or lost solely with the introduction of recovered e-mail and other electronic documentation. If an attempt has been made to delete, erase, or otherwise hide critical evidence, you need the competent data recovery capabilities of Forensic Discoveries.

Evidence that attorneys are not aware even exists is often found during this process. Also, timelines of computer usage can help in crafting deposition questions and in targeting witnesses for interview.

Computer users typically 'delete' incriminating and/or sensitive computer files but the information may still exist in slack space on the computer’s hard drive that is hidden. This computer data may linger for months or even years and it can be recovered and documented using computer forensic methods and techniques.

Unfortunately, there are many examples of computer usage in violation of company policy. Sexual harassment, embezzlement, theft of trade secrets, abuse of the internet and unauthorized outside employment on company time are just a few examples of violation that warrant a forensic examination of a computer. Even in investigations where hard drives are reformatted in an attempt to hide evidence, Forensic Discoveries can still potentially recover critical information. Forensic Discovers can also aid in recovering passwords for critical files that have been maliciously set or changed.

Many times, computers are reissued when employees leave. Continued use of the computer may destroy the incriminating evidence that can be used against a former disgruntled employee. Also, continued use of the computer may raise questions as to who created the incriminating evidence and when. To prevent these problems and to preserve potentially valuable information, we recommend following a strict chain of custody and shut down the subject computer.

Please keep in mind not to try to recover information yourself. These attempts will potentially change crucial information such as time and date stamps, as well as user information, that could possibly impede the successful investigation.

When you are ready to begin the process, please review the Accepted Guidelines, Forensic Process, and Forensic Procedures and begin by initiating a case .