The Forensic Process
Computer, or device, forensics follows a scientific process. Meaning, the end result should be repeatable and reproducible. In the context of litigation, the process must also be defensible. Here is a general overview of the forensic process employed by LCG:
- Formulate a basic understanding of the situation through Client interviews.
- Identify the electronic repositories likely to contain the information you need.
- Forensically preserve these repositories and make appropriate backup copies.
- Track all device information and chain of custody events for defensibility.
- Process the forensic image(s) using task-specific tools.
- Identify the relevant evidence and activity contained on the device.
Most “forensic firms” stop here and leave it up to the Client or Counsel to interpret the evidence and determine its value.
-Ken Tisdel, CEO
The Forensic Process is not the investigation. Rather, it is a foundational methodology used to preserve and identify electronic evidence. The investigation is about determining who, what, when, where and how things happened.
The best investigators know how to use and interpret forensic evidence and, through experience,
- Incorporate the forensic evidence and activity into the investigation (e.g. trade secret misappropriation, fraud, sexual harassment, catastrophic event, etc.).
- Communicate findings and recommendations to the Client with clarity and transparency.
- Conduct peer review by additional LCG testifying experts for validation of methodology, findings and strength of facts.
- Conduct oral testimony as needed in hearings, depositions and/or trial.