A growing trend in investigation and litigation support is "electronic discovery." Electronic discovery is essential because the information needed to build a case increasingly resides on computer systems. In fact, far more information is retained on a computer than most people realize. It is also more difficult to completely remove information that is generally thought to have been deleted. For these reasons (among many), computer forensics can often find evidence of, or completely recover, lost or deleted information, even if it was intentionally deleted. To effectively obtain this information, you cannot simply turn the computer "ON" and start searching. Investigators need to consider issues such as spoliation, preservation of evidence and admissibility as they discover the facts.

What is Electronic Discovery?

Electronic discovery is the collection, preservation, recovery, analysis and preparation of information originally stored on electronic media. Electronic discovery involves much more than merely recovery of computer data. It involves proper evidence handling and preservation, sifting information through a thoughtful investigative process and providing results in a form that can be used by a non-technical lead attorney or court. Electronic discovery is accomplished most effectively when performed in conjunction with a case strategy and an experienced forensic consultant. Computer Forensic Services, Inc.'s electronic-discovery process includes the following components:

Data Collection

Recovery and preservation of electronic evidence is the key to successful data collection. Case relevant information often resides on all forms of computer devices: laptop and desktop computers, floppy disks, CDs, DVDs, PDAs, cell phones, tapes and servers. Recovering data from a wide variety of media and devices is an essential element of data collection and is the core technical challenge. However, technological prowess is not the only issue. Following proper evidence handling techniques, preserving data (imaging) and managing chain of custody are equally important to the data-collection process.

Computer Forensic Services, Inc. performs all aspects of data collection including recovery, preservation and evidence handling. Given the law enforcement background of our trained forensic specialists, we handle all cases as if they are criminal investigations using many of the same techniques. In spite of this rigor, in most cases electronic evidence can be gathered quickly with minimal disruption to the operational processes of an organization. No proprietary software is used in the process, and the security of the gathered information is ensured.

Data Sifting

The data-collection process typically produces huge volumes of information often measured in gigabytes (GB). The shear volume of data can overwhelm the most seasoned investigators and litigation support personnel. Most recovered data is not useful to the case and should be discarded. The challenge is to quickly and efficiently sift through the volume of data to find the key information critical to the case. Techniques often deployed in the data-filtering process include de-duping, keyword and date searches and data segregation. Software tools are often utilized to assist in the data-sifting process.

Computer Forensic Services, Inc. is expert at the data-sifting process, and we take great pride in our investigative capabilities. We spend the extra time to learn the details of the case by reviewing the complaint and associated case documentation before we begin. This step is critically important to ensure the effectiveness of the sifting process. While reducing the volume of information to a manageable size is the main goal, achieving that goal must not come at the expense of missing a critical piece of evidence. Computer Forensic Services, Inc. utilizes standard data-filtering techniques through the search process. We also perform phrase and conceptual searches of all associated information, including attachments. The sifting and investigative process can be iterative and requires coordination and communication between the investigator and case manager. If there is a "smoking gun," we will find it.

Deliverable

The end result of the electronic-discovery process is a final deliverable. Typically, this includes case-relevant information delivered in a form that can be used by legal counsel. This information must be in a form that can be searched and reviewed. In larger cases, the information may need to be imported into litigation software or a central repository service where it can be shared as the case progresses. The original images, electronic-discovery deliverable and overall process could be scrutinized in court.

Computer Forensic Services, Inc.'s electronic discovery deliverable is designed to exceed these requirements and address the productivity of the attorney. We provide original images the latest technology to ensure the integrity and security of the data. In addition, we provide searchable CDs allowing for easy keyword and conceptual search manipulations of the reduced or sifted case-related information. Computer Forensic Services, Inc.'s work product can be imported easily into many applications, including the industry standard litigation support software or central repository services. Computer Forensic Services, Inc. also provides verbal or written reports with key findings of the process and forensic investigation.

Importance of the Forensic Specialist

The electronic-discovery process involves complex data manipulation and reduction utilizing sophisticated software tools and techniques. However, technology and tools are necessary but not sufficient for success. The result that is achieved is only as good as the quality and experience of the forensic expert assigned to the case.

Computer Forensic Services, Inc. is expert at electronic discovery and has years of experience investigating complex cases. We have a knack for finding the key evidence needed to win.