Why should I use a digital forensic examiner?

  • To access and maintain the integrity of the hidden metadata of e-mails and files that you may wish to enter as evidence;
  • To insure that appropriate and proper techniques are employed to forensically acquire and preserve all the evidence that is present so that it will be admissible in legal proceeding (Copying or "ghosting" a drive is not the forensic way!);
  • To prevent spoliation of evidence by properly and carefully handling all digital media, equipment, and software;
  • To start and maintain a Chain of Custody for the evidence;
  • To obtain an expert who has experience in a wide range of computer hardware and software (Since fundamental computer design and software implementation can be similar from one system to another, experience in one application or operating system area may be transferable to a new system.);
  • For an impartial and neutral examination of the digital media;
  • So that business operations will be affected only for a limited amount of time, if at all; and
  • So that any client-attorney information that is inadvertently acquired during a forensic exploration is ethically and legally respected and not divulged.
  • Caution: Do not use your client's IT personnel, for they usually lack the forensic software, hardware, and training to prevent spoliation of the evidence.  (You don't want to lose your case because opposing counsel's forensic examiner shows the jury where your evidentiary files' dates have been changed, do you?)
  • Remember: A forensics examiner is much better at explaining the procedures employed to obtain your digital evidence and defending it against tampering charges than most attorneys and IT personnel.