The famous Jim Sanborn sculpture, Kryptos, illustrates a need for thoughtful investigation to solve difficult problems

When asked to investigate an important computer forensic matter – we assume that we will need to provide opinions via reports, declarations or testimony. We take care to manage evidence and provide opinions based on the evidence. Attorneys represent the parties; we represent facts. This is particularly helpful when a smart phone or computer holds important clues that relate to the case.
If evidence is obvious, anyone can find the solution to a mystery without an investigation.

We specialize in cases that require more than a superficial understanding of details. The situation gets particularly complex when false information is planted during the investigation, computers are altered or details are forgotten. This is similar to the issue faced in the “wilderness of mirrors” by counterintelligence operations.

Case Study: Catching an employee who hid his tracks

The mystery had lots of moving parts: encrypted computers with unknown passwords, an access control system that was bypassed, good video coverage which coincidentally had been deleted from servers, and a company policy generously rewarding longevity. One employee was suggesting others were culprits, had an alibi that turned out to be forged,… and was the incompetent manager who we identified as the crook. His longevity and six figure salary were shortened by our investigation. We worked as part of an investigative team in this case. Digital evidence was a valuable clue. Broad investigative and technical capabilities let us reach a conclusion.

Launching an Investigation

If you think that your client faces a multi-dimensional challenge of this sort call (888) ESLEUTH. Be careful to preserve critical information that may be in network logs, company PCs, cell phones, access control systems or video security systems. They will be important when an investigation begins. Resist the temptation of the IT department to “just fix” the PC that may have been altered –without preserving evidence on the machine using forensic techniques.

Expect to get useful information based on facts

Often we are asked “which side are you on?” The question assumes that we are attorneys representing a client. Actually, we represent the facts. When we present a report its focus is on evidence in the case, not the desires of the various parties. If you hear your forensic specialist agreeing to bend facts, expect that you will be in a very uncomfortable situation.

Act on investigative results

As investigators, the good days at work are discovering factual evidence that gives clear conclusions for our clients. The worst days are when our client doesn’t take action. Here’s an example: We were retained by a local government that was being sued by several employees. The computers that we analyzed clearly showed that the employees were faking their claims. In the process they were falsely accusing innocent parties. The case went to a jury that agreed with the facts and threw out the suit. Unfortunately, years later these fraudsters still had their jobs. No action was taken!