Peak Forensics can assist on projects ranging from a few computers to large scale collections involving workstations, network storage servers, email servers and portable devices.
Engaging a computer forensics expert early on in your matter will allow the expert to assist you in determining relevant sources of Electronically Stored Information (“ESI”) to be collected. Pre-planning also allows the expert to assist you in thoroughly forming protective orders and interrogatories to reduce the amount of time spent going back and forth with the other party or parties. Additionally, during this phase, adequate preservation letters can be drafted to ensure relevant data is available for collection.
The forensic collection of data utilizes specific, court approved and verifiable tools and methods for acquiring and collecting ESI, guarding against an inadmissibility ruling or a challenge of validity. For these reasons, it is recommended to not use a party’s in-house I.T. worker to collect ESI. Collections can be done on-site or at the Expert’s facility.
Depending on your specific needs as determined in the pre-planning phase, analysis may be as simple as reporting on deleted files or as complicated as determining which office workers copied specific files to removable drives or emailed client lists to their personal email addresses. Analysis is often a multi- step process as newly discovered data invariably leads to new searches. A well defined end goal helps clearly define this analysis and keep costs in check.
Findings from the analysis phase are only of use if they are communicated in a clear, concise and manageable format that you as the end user can apply to your efforts. Whether the report is a detailed expert report for the court, an affidavit, a detail of findings for your incorporation into a document or simply a memorandum of findings, information must be presented to you in a manner that is applicable, usable and professional.
Be it to Judge, Jury or Arbiter, expert testimony can make or break your case. The expert must not only be able to effectively convey his findings, but do so in a manner that convinces the court or jury of his credibility. Ensure that your expert has both the technical knowledge to report his findings as well as the experience level to present those findings to the court or jury. Many “tech” people are very good at what they do, but without hundreds of hours of testimonial experience, they may not be able to effectively communicate their findings. This is further reason to use a qualified computer forensic expert rather than in house personnel or I.T. Staff.