Understand Your Data Forensics

Freemyer is the Director of Forensics and Disputes and primary testifying witness for SullivanStrickler, which offers bespoke legacy data and eDiscovery support solutions, including forensics, collections, culling, processing, and production, as well as tape, data, and voice restoration services. Freemyer, who has 15 years of experience as a testifying computer expert, and his certified team of forensic analysts help clients to carefully navigate and retrieve fragile digital information, minimizing the risk of compromised data or legal defensibility.

The Scope of Forensic Data Services

While one may assume data forensics revolves around tracking down cybercriminals, its application extends far beyond: the term “data forensics” refers to any instance of applying computer science and electronic data to law. When a service provider is hired to copy or analyze electronic data to present it – or potentially present it – in court, that’s data forensics.

While these service providers are known for their work carefully extracting and making copies of evidence, they are also frequently called to testify as experts. The bulk of the work involves three mediums:

1. Computer Forensics

Computer forensics work focuses on evidence found on computers. For example, it often involves companies that are either investigating a departing former employee or proactively defending a newly hired employee. It’s not uncommon for an employer to enact a temporary restraining order (TRO) preventing a former employee from conducting business in a new job.

2. Cloud-Based Forensics

Cloud-based forensics includes emails, OneDrive, Dropbox, and other mediums. There are a wide variety of applications, and as cloud-based systems grow, so does the demand for this type of forensics work. According to Freemyer, an increasing amount of the work brought to SullivanStrickler involves marketing and business communication platforms, such as HubSpot and Slack.

3. Mobile Device Forensics

Many legal matters now require production of text messages from smartphones. In addition, with the wide adoption of distraction-free driving laws, lawsuits involving automotive accidents (in particular, between semi-trucks and other vehicles) increasingly depend on data forensics experts to both retrieve information and testify to mobile device usage near the time of the accident.

How Data Forensics Services are Transforming the Legal Landscape

Currently, data forensics occupies an approximately $2 billion market share. The sector has grown at a rate of 6.9% over the last five years and shows no sign of slowing down. Indeed, the expansion is understandable given the recent acceleration of cloud and digital transformation and the massive impact of electronic data on the legal landscape.

Hearsay No More

Digital communications are easily preserved and replicated. Whereas some lawyers complain verbal conversations are often deemed hearsay and inadmissible in court, they inform us electronic communications – which are often time-stamped and archived – can typically be used as highly reliable sources of evidence which are easily admissible.

However, collecting that information and assembling it in a meaningful way is a monumental task, and many legal professionals prefer not to do it alone. That’s where forensic data services come in. For example, SullivanStricker can efficiently thread jumbled, disparate conversations into a PDF. The company is even able to bubble theme text messages to mimic their appearance on mobile devices. Years of message communications can be threaded into a single PDF that is easy to scan and review.

Neutral-Party Data Forensics Services

It’s not unusual for a legal dispute to involve data stored on one party’s electronic devices. Claiming that they don’t trust the other side, the owner will refuse to turn the devices over, but the requesting party will insist that the other side is withholding evidence.

At that point, the best solution is to hire a data forensics service as a neutral party to retrieve the information. It’s as simple as providing a protocol and making clear what information to look for, what information to exclude, or what specific keywords to screen.

When Forensic Experts Are Brought in Too Late

While companies and legal professionals rely on data forensics to do their work, they rarely possess the capabilities or expertise in-house to successfully perform the job. That’s because it can be difficult to access and copy digital information without modifying it in the process. But once digital evidence has been compromised, it is lost or useless. Another common, problematic issue is spoliation as there are steep negative inferences when defendants intentionally, recklessly, or negligently withhold, hide, alter, fabricate or destroy evidence.

Unfortunately, and all too often, SullivanStrickler is brought in after organizational mistakes have already been made. As Freemyer says, “I’ve been in cases where the defendants typically will spend significant amounts trying to re-create what would have been a low-cost situation if they would have done it right initially.” He cautions companies and legal professionals against attempting to perform their own data forensics work if they don’t possess the proper skill sets and tools.

The Prerequisites to Undertaking Data Forensics

When it comes to data forensics work, you’ll need the capabilities and expertise to accurately search legacy data and extract relevant information, as well as compile meaningful, unbiased sets of evidence. Often, the best option is to work with an adept and experienced service provider.

Client to Sullivan|Strickler:

“We want you to collect cell phone content, then parse it and structure the data in such a way that we can ingest it into our e-Discovery tools.”

– Greg Freemyer, Sullivan|Strickler

Freemyer explains the benefits through the lens of his own company. According to him, clients seek out SullivanStricker because each certified member of their forensic data team is qualified to testify as an expert in court, which is a major benefit to clients.

Freemyer also points out the importance of taking digital information and configuring it for import into eDiscovery tools. A prime example would be a client coming to SullivanStrickler and saying, “We want you to collect cell phone content, then parse it and structure the data in such a way that we can ingest it into our e-Discovery tools.”

To perform those services, the SullivanStricker forensics team relies on a host of tools, including Celebrite, X-Ways, ESI Analyst, Axiom/IEF (an internet evidence finder), and USB Detective. Further, SullivanStrickler has a suite of eDiscovery tools with which to test data being handed off from the forensic team to their client’s eDiscovery teams. The company uses its own tools, including Invenire, the world’s most advanced metadata review tool, and LEAR, a legacy email archive with search filter and export capability, as well as X-Ways, an advanced integrated computer forensics software. Of course, team members also draw from their skill sets, experience, and industry-standard certifications to best fulfill the needs of their clients and the courts.

Ultimately, data forensics work is vitally important, but it’s also tricky and expensive. SullivanStrickler does its best to serve cost-conscious clients by offering the option of onsite or remote collections anywhere in the world, cutting the travel expenses of other companies, and maintaining three strategically located offices in Atlanta, Georgia, Austin, Texas, and London, England.

SullivanStrickler has certified data forensic experts who manage every facet of forensic data recovery. Identification, acquisition, preservation, analysis, and documentation of electronically stored data are coordinated as required for whatever the matter at hand.

Our forensic experts increase the efficiency and accuracy of the digital forensic investigation process, without altering or compromising fragile digital information or risking defensibility.