Managing Costs of Computer Forensic Investigations, Part 1
Managing Costs of Computer Forensic Investigations
Most business activity interfaces with computers, cell phones or tablets today. Therefore, when an issue arises that requires a digital forensic investigation, business leaders and counsel must pay attention to electronic evidence that resides on these devices. I am not talking just about “files,” such as spreadsheets and other documents. Rather, there is often a plethora of trace evidence related to the use of these devices and the interaction of files contained on them. This trace evidence can help prove or dispel your theories by providing initial insight into who, what, when and how certain events occurred. So, how do you get to this information without breaking the bank?
The answer is found in a phased approach to computer forensic investigations. Instead of trying to understand the complete universe of data out of the gate, speak with an experienced forensic expert about the most important question you want to answer first. For example, if your primary question is, “Did this former employee take our company information or trade secrets?” then the initial focus should be on determining what modes of transfer were used – the most common being USB devices, cloud storage or webmail. The forensic expert should be able to image the computer and extract the information that reveals data transfer activity for a fixed fee. With this information in hand, you will be well equipped to make strategic and legal decisions and will have done so at a reasonable cost. In future articles, we’ll cover more tips about managing costs as a forensic investigation progresses.
Learn more about Computer Forensic Investigations: LCG Discovery Experts