Why Use Digital Forensics?
Working in the digital forensics field has opened my eyes to
many other professional practices. Specifically in my job I deal with a lot of
lawyers, law firms small and large, and plenty of litigation protocol. One of
the most interesting aspects of the law field to me and specifically when
dealing with on-stand experts, is that you don’t ask a question you don’t
already know (or think you know) the answer to. This important factor made me
think: Why don’t more litigators use digital forensics in their cases? Having a
certified forensic expert helping you in your case is like giving you the
answers to questions you haven’t even thought about asking!
Recently I worked in Chicago where I collaborated with
lawyers throughout the country who had various levels of experience with
digital forensics and computer investigations. One of my most memorable cases
was an attorney from a very small law firm in the suburbs of Chicago who dealt
with Employment and Labor law. This attorney had come to me with ongoing litigation
concerns about an employee who left a company and went to work for a direct
competitor within a matter of weeks.
This employee had been in a position where they were privy to a lot of
sensitive data about the company (product specs, pricing models, client lists,
sales leads, etc.). While we already knew that the employee had violated their
non-compete contract, counsel was worried that the business might have been
harmed by the theft of this sensitive information. I was brought in to either
put these fears to rest, or create a “slam dunk” case with empirical digital
evidence.
Not long after our initial conversation where I addressed
what kind of things we may find in a digital investigation, counsel was able to
procure the work laptop from the company. Within a week of receiving the device
I was able to image (duplicate the evidence to be able to work on a copy),
parse, index, and analyze the entire system. Combined with a simple
questionnaire from the client, I had a complete understanding of the activities
on the system. In this case (as with most investigations) I focused on the
employee’s last two weeks at the company. I was able to pin down that before
leaving the company (and pretty much right before walking out of the door) the
employee was attaching USB thumb drives to the system, and copying data to
these drives. Along with the USB devices, I could see that through emails and by
viewing his Internet history (Gmail, DropBox, LinkedIn) that the employee had
been planning to leave the company for some time. The combination of the
employee’s actions, coupled with solid digital evidence, proved that sensitive
information was taken from the company laptop, and copied to personal devices.
Information provided by digitial forensic examination of the laptop provided
counsel with ample means to win their case.
The best part for me on a personal level was that this case
was the first time the attorney had ever used a computer investigation. It
provided me the ability to teach counsel exactly what we do, how digital
forensic science is proven in court, and how best to phrase his questions and
shape his case to present what we found. Not only was this his first case
involving digital forensics, but it was my first deposition as well! That give
and take provided a great working relationship for the case going forward and
the follow on investigations that arose from it.
At Wapack Labs we are driven to
provide that same level of service to litigators throughout the Employment and
Labor, Intellectual Property, and Technology law practices. Give us a call to
see how we can help! Find us online at
