ECC Home
. . . . . .
References
Rates
Contact us
Expert Computer Consulting - 184 Eaglecrest Drive, Matthews, NC 28104 (704) 882-7551 or (704) 609-1970
Saturday, February 23, 2002

Forensics Counsel

So, what is forensics counsel?

Simply put, it is the services provided by a non-testifying expert whose communication with the attorney remains confidential and protected from discovery. The advantage of such a relationship is that the expert may be included in strategy planning sessions and can often provide valuable input on the subject of what evidence is, or may be, available for use in the case.

Familiarity with what most users will do on their computers and what evidence their acts will leave to be discovered can result in production that would otherwise go unnoticed and overlooked. Knowledge of where specific software packages leave files behind and what their contents are likely to be ads depth to the possible sources of evidence.

Many cases will preclude the luxury of this valuable resource; but if you believe there to be significant injury and can afford an extra few thousand dollars, retaining me in this capacity could be the best assurance you may find.

In but a few hours, I can suggest where to look and what may be found. Should discovery be made on any other systems, such as a home computer? Is there any removable media or are there any third parties involved? These questions and more, I can answer for you; efficiently and succinctly.

Evidentiary Work (Forensics)

If I can't find what you are looking for, nobody can.

Why call a company hundreds of miles away when truly expert help is close at hand? Telephone inquiries are free, so why not call with your questions? (704) 882-7551

Even years after the data was erased, or after deliberate attempts to wipe the files that might be damaging, there are most often remnants left behind and I can find them. Additionally, since virtually everything done on a computer is clearly marked with the date and time, the evidence produced is incontestable and easily stands on it's own.

The pervasiveness of the personal computer in modern society and the uses it is put to make it one of the best sources for precise information that is so clearly marked as to make it virtually unimpeachable as evidence. Imagine how powerful the evidence would be if the contents of each conversation were included in the phone bill's listing of the phone calls!

There are three keys to success in performing this type of work. Two of these are relatively simple, founded in the rules of evidence, and consist of the evidence itself and the credentials of the expert hired to present it.

The third key, which is much harder to find, is the ability of that expert to extrapolate and interpret what has been found during the first searches for evidence to derive what may produce additional results. In my experience, it has always been the later searches that have produced the most damaging evidence.

In family law cases the tax returns, bank accounts, financial transactions, letters written, E-mails, downloads, web sites visited, and even their contents are there to be found by anyone who really knows what to look for. Once found, each item is clearly marked with far more identifying detail than anything else commonly available.

Civil, employment, and contract law suits can easily become a guaranteed win situation when it is possible to show exactly what was done on a computer, or what was sent to whom and when it was sent.

With over twenty years of data recovery experience and seventeen as a recognized expert, I have the expertise to find what is needed to support your arguments and the credentials to support it's presentation. I have produced evidence used by several law enforcement agencies, in several federal court proceedings, in the courts of Maryland and the District of Columbia, and in virtually every court in Virginia, including the state's supreme court.

.Back to Top

A Few Case Examples

When fifteen computers were stolen from Towson State University in Maryland, the Arlington County Police department brought me what they believed to be one of them. Even though the hard disk had been formatted and the software reloaded, less than an hours work located letters written by the faculty at the university, thereby proving their source.

A full partner in Bethesda decided to start his own business and even sent faxes to existing clients encouraging them to do business with his new company, he thought he had been clever enough to erase all the evidence. What he didn't realize was that the business cards he printed had left a print file behind that produced a beautiful sheet of cards, that everything he had faxed had left copies no less than three separate places, and that even parts of his new web site were to be found amongst the "temporary" files.

After a major retailer had sold a "store demo" laptop computer to an unsuspecting individual, he almost lost his family. Unbeknownst to the gentleman, two of the retailer's employees had spent hundreds of hours downloading pornography, which he didn't find, but his son and neighbor did. I produced the evidence of the employees having opening the internet account and the sequences of dates and times the files were downloaded; all of which occurred months before the computer had been purchased.

Three full years after the child molesting husband had broken back into the family home to erase the evidence of his secret desires, the links to internet pages requiring paid access to underage pornography were still there.

The big guys had decided they wanted a piece of the pie so they lured the VP of a specialty insurance firm into working for them. He, too, had erased all of his work and even used Norton's Wipeinfo utility; but, there to be found on the office computer, was the E-mail he sent home with all of the spreadsheets and presentations for pending business. Also to be found were the correspondences with clients and his new employer. For the coup-de-grace I found a major presentation on his home computer that had been given by the new employer, containing pages from files only to be found on the old firm's server.

Back to Top