Computer Forensics is the foundation of the electronic document discovery process in interpreting data and metadata to reconstruct files and events. The field of Computer Forensics exists as a result of the transition by the business world from paper record keeping to electronic document storage. Computer Forensics and Electronic Evidence investigation has become a key component in civil and criminal litigation. Electronic evidence is heavily relied upon to describe actions or accounts of actions that led to an event, and to uncover hidden or obscured information.
The Computer Forensic Expert's role is to provide electronic litigation support by investigating, identifying, preserving, analyzing, and presenting electronically stored information found in various devices, including but not limited to computer networks, hard drives, external storage devices, PDA's and cell phones. Providing superior electronic litigation support is the mission of Data Triage Technologies.
The e-Discovery process often entails the investigation of computer systems to determine whether there has been use for illegal or unauthorized activities. Recovered data is used as supportive evidence in various types of litigation including, but not limited to, Intellectual Property Disputes, Labor Law Disputes, Sexual Harrassment,and Illicit Use of Company Property for Personal Gain.
Using commercial and proprietary tools, Data Triage’s computer forensic investigators have the ability to recover, reconstruct, and analyze data including document files, e-mail, images, audio, and web-based data. The information can then be catalogued and imported into a document management tool, such as Concordance or Summation, that attorneys can use for review.
Data Triage Technologies’ computer forensic experts have the ability to condense and present vast quantities of complex technical electronic information in formats that are concise and in layman’s terms. Analyzed data can be prepared for use in declarations, interrogatories, depositions, computer expert witness testimony, and rebuttal.
Data Triage Technologies adheres to the Federal Rules of Civil Procedure for Electronic Discovery. Evidence obtained may be used in various manners including but not limited to:
- Computer Forensics Expert Witness/ Neutral Computer Forensics Expert
- Computer Expert Witness Rebuttal
- Draft Protocol for Electronic Discovery
- Create a Repository
- Preservation of Electronic Documents
- Fully Documented Chain of Custody
- Open Password Protected/Encrypted Files
- Reconstruct Files, Emails, Activity Logs
- Demonstrate Evidence of Spoliation
- Demonstrate/Prove Transfer or Dissemination of Proprietary Data
- Reconstruct Internet History
- Construct/Reconstruct Time Line of Events
- Reconstruct Phone Logs/Text Messages
- Locate assets by reconstructing accounting software, (QuickBooks/ TurboTax)
- Mitigate allegations of spoliation
The process of identifying devices containing electronically stored information relevant to the support of claims and/or defenses of both parties is the first step in electronic discovery. To support their claims within the electronic discovery process, each side must produce documents that contain specific search terms and parameters. Data Triage Technology is distinguished in the field of Information Technology and Litigation Support. DTT’s computer forensics experts have an in-depth understanding of the complex field of information technology and are versed in identifying, preserving, and analyzing storage devices containing electronic evidence in a variety of network and business environments. DTT’s computer forensic experts’ in-depth knowledge of the arrangement of data and metadata assist the attorney in propounding effective electronic document requests as well as insuring compliance with the court's directives.
Once the identification process is complete, the digital storage devices require preservation to insure the integrity of the electronic evidence obtained during the computer forensic investigation. In the normal course of business or if digital devices are not preserved properly, electronic evidence could be deleted or overwritten. Electronic data collection is the process where electronic evidence is copied to prevent the possible spoliation of electronic documents. The use of dedicated computer forensic software and tools are necessary to ensure that the copy process is performed properly. DTT’s computer forensic experts utilize software tools and protocols that have been approved and validated by the courts for this process, ensuring the data is admissible.
