When asked to investigate an important computer forensic matter – we assume that we will need to provide opinions via reports, declarations or testimony. We take care to manage evidence and provide opinions based on the evidence. Attorneys represent the parties; we represent facts. This is particularly helpful when a smart phone or computer holds important clues that relate to the case.
In a substantial civil case, we were asked to provide an opinion. An attorney’s declaration claimed that ALL of the unallocated area in a hard drive had been overwritten with an unusual pattern of characters. They formed shapes similar to the letter W. Because spoliation of evidence by wiping a hard drive is a serious matter it became an important question.
In order to clearly define the situation, we chose to write custom software that could examine the hard drive while accommodating a number of variables. Indeed we did discover W patterns… but they were inside the Microsoft Word program. A scan through the hard drive found no W patterns anywhere else. This provided a clear, factual answer to the spoiliation issue… it really wasn’t an issue. The federal court judge agreed.
The case was then promptly resolved with no need for testimony.