If I think that evidence exists, is it ok if my Technology expert takes a look for the information before I get in touch with a Computer Forensics Expert?

Most in-house technology experts are concerned with mission critical data and recovery from catastrophic data loss. They are not expert in the acquisition and preservation of data rendered invisible to the operating system. Even the most well intentioned Technology expert can damage the fragile information that is stored on a computer, especially when the operating system does not recognize the data. The simple act of turning the computer on or looking through files can potentially damage the very data you’re looking for. Dates can be changed, files overwritten and evidence can be corrupted.

Additionally, using in-house personnel can raise issues related to authentication that can increase the cost of admitting evidence. In-house personnel may be put through a Daubert/Frye challenge that could threaten the admissibility of critical evidence. If there is a remote chance that the matter could end up in court, best practices strongly suggests having the data analyzed by a computer forensic expert. The cost of expert analysis will almost always be far less than the cost of defeating a challenge to the admission of critical evidence.

Close