COMPUTER FORENSICS

With over 90% of the world’s business documents being drafted on computers and the relentless use of e-mail, instant messaging and internet business by nearly everyone, much of today’s civil litigation evidence can be derived from computers. DS INVESTIGATIONS has a computer forensic investigation team with the ability to locate and recover any and all relevant information or traces of same that may exist on a computer or storage device. This includes recovering items such as e-mails viewed but not “saved”, websites visited, deleted documents, uninstalled software, etc. The great news about this type of data is that unlike a piece of paper which only shows us what we can see, electric data can have information about it’s creation, multiple versions of that information, who it was transmitted to, history of it’s use, etc. We are proud to say that if a piece of information exists on a computer or storage device, we will be able to locate it and produce it for inclusion in evidence.
Computer Forensics

This type of computer forensic investigation should not be confused with the type of searches the average I.T. employee or computer consultant will conduct. We employ a number of methods and investigative tools to locate and reconstruct each file or fragment, often including deleted items and fragments that other I.T. Consultants reported did not exist. Many of our clients, as well as the opposition, are often surprised at what we are able to find that was thought to be deleted or erased.

We can recover electronic evidence during a computer forensic investigation from the following types of devices:

* Hard Drives
* Back-up Storage Media
* Databases
* E-mail Servers
* Web Servers
* Internet Sites
* Personal Digital Devices (Blackberries and cellular telephones)
* Digital Cameras
* Zip Drives
* Fax Machines
* Digital Answering Machines

Our computer forensic investigations are conducted in a forensically sound manner, thus preserving the integrity associated with that piece of electronic evidence. As licensed private detectives, we are in a far better position to find evidence, than the office I.T. guy or other companies, because we already have the investigative knowledge, training, and mindset. We have a multitude of court recognized software programs and tools to employ along with our vast experience in both the technological aspects as well as generally accepted investigation practices. This combination is vital to preventing any corruption of the evidence. Make no mistake, one does not learn how to conduct this type of investigation and become a computer forensic expert in a classroom alone. Microsoft does not certify people to conduct this type of investigation. We are unique and if you end up encountering us in court, you may learn that the hard way.
Features

* Forensic Computer Investigations conducted by licensed private detectives
* Priority on site data capture allowing your client to begin using the computer in question immediately
* Court recognized expert forensic investigators
* All computer forensic experts have extensive experience testifying in court
* Circum Vitae of our experts available upon request

Benefits

* Evidence that frequently cannot even be produced by your opposition is now available to you.
* Our work product confidentiality is protected by law
* Evidence can be collected wherever the computer/storage device is located and is stored at our location to protect chain of custody
* Cost effective evidence collection without parallel.

Hiring a Computer Forensic Expert

*
Post Transmission Storage is Fair Game
White v. White. New Jersey domestic decision making post transmission electronic media storage fair game.
*
Employment Litigation and Computer Forensics
Employers, you face special issues concerning computer forensics. We recommend you read this article.
* 
San Diego businesses embrace Computer Forensic Investigations to protect themselves
*
Computer Definitions
*
Aggressive Pursuit of Spoliation Reaps Rewards
Excellent article on computer forensics and spoliation issues. Copy also available on Harvard Cyber Law site
*
Allowing the Defense to Examine Contraband
2002 Texas Appellate case allowing the defense to examine forensic image.
*
White v. White
New Jersey case allowing a private investigator to recover email from a hard drive and using it in court.
*
Westerfield v. The Superior Court of San Diego County
California case allowing defense to obtain copies of contraband material derived from computer forensic investigation.
*
Crown Life Insurance v. Craig
US Court of Appeals case discussing sanctions against Crown for failure to comply with discovery order requesting raw data from a database to be examined directly.
*
Preservation: Analysis
Analysis of data preservation and its impact on litigation. Copy also available on Harvard Cyber Law site.
*
Discovery and the use of computer based information in litigation
Well known article from the Rhode Island Bar Journal by the esteemed Peter Lacouture, Esq. from the mid-1990s. The title says it all. Copy also available on Harvard Cyber Law site.
*
Gates Rubber v Bando Chemical Destruction of Evidence
Gates alleged chronic and continuous destruction of evidence and other violations. Court dismisses most of its claims, but does find that defendant destroyed word processing files that warranted sanction of ten percent of attorney¹s fees. The case has a long discussion of the elements of spoliation and the need for evidence of what was spoliated as a basis for drawing inference, and finds no spoliation.
*
Required disclosure of customer communications or records
Quick recap of Title 18 covering disclosure by ISPs.
*
Lexis-Nexis v Beer Sanctions
Employer sued employee for misappropriation to trade secrets. Following temporary restraining order requiring employee to turn over copy of database he made when he resigned, employer moved for sanctions, claiming employee had destroyed critical parts of database to avoid discovery and in violation of TRO. Court found that sanction of drawing inferences against employee for missing info was not appropriate, but imposed monetary sanctions against employee for violating TRO.
*
Linnen v Robins Failure to Preserve
Fen-Phen litigation. Defendant Wyeth fails to preserve emails and then fails to turn over all emails and database info requested in discovery and subject to court order. This memo orders production of relevant emails by Wyeth and imposes costs of production on Wyeth. Also sanctions Wyeth and allows spoliation inference to jury for Wyeth¹s destruction of emails. Refers to “inexcusable conduct” by Wyeth several times.
*
Mathias v Jacobs Spoliation
Spoliation of information in Palm Pilot. Court ruled that Plaintiff had duty to preserve info in Palm Pilot that she knew might be relevant. But info is still discoverable, albeit in a more difficult way, so does not warrant dismissing case of allowing adverse inference. However, monetary sanctions imposed from costs as a consequence of spoliation.
*
P&G v Haugen Failure to Preserve
P & G sued competitor and competitor¹s distributors for spreading rumors of P & G¹s Satanism, specifically alleging defamation, unfair competition, violations of Lanham act, Utah Truth in Advertising Act, etc. Judge Kimball dealt with various motions here, including sanctioning P&G for failing to preserve relevant emails, and allowed P&G to do a keyword search of Defendant¹s database on issues concerning agency or control in general, but limited search so that it would not yield general commercial or competitive information.
*
US v Koch Destruction of Evidence, Sanctions
Detailed analysis and discussion of digital discovery issues and problems. Shareholders filed claim under False Claims Act, alleging that oil company understated quantity of oil produced from federal and Indian lands. Plaintiffs claimed that company thwarted discovery attempts by destroying backup tapes and files. Court found that Plaintiffs had failed to show that Defendant engaged in willful acts to thwart discovery, but the Defendant failed in its duty to preserve evidence that it should have known was relevant, and many files which should have been preserved were destroyed due to D¹s negligence. Court did not allow adverse inference instruction to jury, but did allow Plaintiffs to inform jury which tapes were destroyed and the impact of the destruction on their case.
*

Quality Computer Forensic Links