Frequently Asked Questions about digital equipment in legal cases.

When you are aware that a computer may have been used in a crime, divorce, or in any legal matter what is the first thing you should tell your client?

First and foremost, you should make sure the computer in question is turned off and not used until someone with experience gathers the data needed from the machine.  Every SINGLE thing you do on a computer leaves a trace, but more importantly you can OVERWRITE files that might be very valuable. Immediately after contacting your forensics specialist they should gather the equipment for data analysis and recovery. They can often provide you with a cloned copy within 24 hours so that regular business is uninterrupted.

What should I do if the computer has already been in use?

The same procedures mentioned above apply.  The only foreseeable problem with a computer that has been in use is being able to decipher what information has been tainted or overwritten.

How long after I find out there is a computer should I wait to try to acquire it? Immediately.  You should contact a forensic specialist as soon as possible to make a copy of the data you think is vital to the case.  A computer can contain very valuable information about your case and having this information early on can help you prepare for the case.  You should never wait until the last minute to see what critical information is there.  Often times, data is lost because the information has been deleted, overwritten, or tampered with. If there is a chance a court order will be required to gain access to the data, then filing should take place as soon as possible so there is no chance for the data to be destroyed.   Protection of evidence is critical.  A knowledgeable computer forensics professional can protect and ensure that the computer system is carefully handled. Your benefits: Evidence is not damaged, destroyed, or otherwise compromised by the procedures used to investigate the computer. Computer viruses are not introduced to a subject computer during the analysis process. The system is protected so that future damage does not occur and a continuing chain of custody is established and maintained. The time a business will not be able to run without certain equipment is shortened. Ensures the client-attorney information acquired during a forensic investigation is protected.   If you have another question, want more specifics on something you have read, or if you would like to inquire about hiring Forensic Strategy Services, please call or email us at: Forensic Strategy Services, LLC. 601B Industrial Court Woodstock, Georgia 30189 ph 770.926.5588 fax 770.926.7089 email:info@forensicstrategy.com

 Home | About | Questions | Newsletters | Experience | Resources | Team | Services | Presentation