When should I consider using Computer Forensics?

A good rule of thumb is to use Computer Forensics as a tool to (1) determine the facts from your client, (2) discharge your duty to avoid spoliation, (3) obtain all relevant evidence from the opposing party in a manner similar to using a Request for Production of Documents, and (4) determine whether computers were used as the instrumentality of a tort or crime.

Determine Facts from Client. An attorney must have all the information relevant to a matter, not only to construct effective legal strategies, but also to focus your client’s expectations, and efficiently price your services. There is nothing more difficult to address than a case that has become complicated by new facts, where you client expected the matter to proceed smoothly and without significant cost. Knowing all the facts early in a matter, allows you to better prepare your client for those cases that will require significant legal expertise to manage.

Discharge Duty to Preserve Evidence. In response to pending litigation, analyzing your client’s relevant computers is an excellent way to discharge your duties to preserve evidence and avoid spoliation, while also acquiring all relevant information essential to your legal theories and strategies. Similarly, as part of critical business decisions, forensically analyzing relevant computers can provide essential information. For example, analyzing the computers of corporate officers or employees as part of the termination process can alert you to possible litigation issues such as violation of non-compete agreements, improper copying of intellectual property, etc.

In Lieu of Request for Production of Documents. In litigation, an attorney ought to determine whether a Request for Production of Documents will obtain all relevant evidence. You might simply ask yourself whether you want to discover part of the relevant information (i.e. that seen by your opponent’s operating system) or all of it (deleted, hidden, orphaned data, etc). It is not unrealistic to anticipate that information contained on a computer system that is helpful to a matter would be saved, while that which is harmful would be deleted, hidden, or rendered invisible. For example, in sexual harassment cases, it is not unusual to discover deleted emails and other data invisible to the operating system that significantly affects the case. Computer forensic analysis extracts all the emails, memos, and data that can be viewed with the operating system, as well as all invisible data. In many cases, the invisible data completely changes the nature of a claim or defense, leading to early settlement and avoidance of surprises during litigation.

Computers as Instrumentality of Crime or Tort. In any situation in which one or more computers may have been used in an inappropriate manner, it is essential to call a forensic expert. Only a computer forensic analyst will be able to preserve, extract, and analyze the vital data that records the “tracks” left behind by inappropriate use. Taking the wrong steps in these circumstances can irretrievably destroy the vestiges of wrongful use that may result in litigation or criminal prosecution.

Close