In Computer Forensic Analysis, the Broader the Scope the BetterHave you ever heard about the form of marketing called drip marketing? It’s where a little bit of information is “dripped out” a little bit at a time over an extended period. It reminds me of the form of torture where it is set up that a drip of water is dropped on the victim continuously for hours.

Sometimes we see that kind of dripping out of information on cases we get. Let me illustrate with a case we handled for an international firm.

The chairman of the board of the firm contacted us because of our computer forensic services. The vice president of operations had been terminated primarily because of he was suspected of breeching corporate confidentiality and engaging in activities that resulted in sharing company secrets with the competition.

They provided the executive’s computer and asked us to complete a forensic analysis. We were given a limited amount of information, a very short list of key words and a very small window of time. Using this criteria, we found nothing and reported that. They expanded the scope, the list of words and the timeframe. Again, nothing. A third time, the scope was broadened and we repeated the process. The last time through, we did find some inconclusive material but nothing that could be considered “the smoking gun.”

The point I want to make is that we repeated the process three times. If the broader scope had been provided initially, the time it took and the cost would have been significantly less.

The computer forensics expert is a technician. The information he gets and testifies to in court are the facts. There is no conjecture. He reports just the facts of what was found and everything he does and finds is confidential.

When we work with clients, especially attorneys, they give us a window of knowledge. Sometimes it’s exploratory or the information gathering part of their practice. The results of the computer forensics analysis helps them decide whether or not to move forward with a suit and their case. That was the situation with the VP termination. They decided they did not have the evidence needed to pursue an expensive suit.

If time is of the essence, the more information we get initially, the better.

-T. Wilcox, CEO, International Investigators