Analyzing Computer Evidence Utilizing Court Certified Forensic Tools
Utilizing court certified analysis tools including Guidance Software’s Encase and Access Data’s Forensic Toolkit (FTK), you can be assured your evidence will meet discovery demands and stand up in court.
The search parameters and keyword list of important terms, names and documents you provide regarding your case are analyzed for matches, cataloged and presented in a final report for use by you or your attorney.
You might think “I’ll just have my IT person or another employee look through the data”…
If you do, you are running the risk of spoiling the evidenc which will make it inadmissible. Every time the drive is turned on and accessed, data is being deleted and/or overwritten. Time and date stamps crucial to evidence integrity is modified.
Let’s say an employee departs your company, a few weeks later or less, you notice a drastic drop in sales and/or clients. Would you feel comfortable putting that person on the witness stand instead of a forensic specialist to try and explain what they looked at, what they found only to be asked to produce the device and then discover the evidence is inadmissible because the time and date stamps were changed?
To avoid this embarrassing situation and the potential loss of your case it is vital that computer evidence is properly acquired, handled and analyzed.
To perform a computer forensic analysis, a forensics specialist will acquire and analyze the hard drive for evidence of communications with the departed employee about moving to the new company. They can also determine if files such as client lists were copied to removable media and/or e-mailed through a corporate or web-based (personal) e-mail.