Our experience is part of the reason attorneys turn to us. In fact, it is our knowledge and experience that can really make the difference in some cases.
For instance, we were tasked with completing a computer forensic examination on a work computer used by a person accused of providing confidential information to a competitor. The accused knew his computer would be submitted to us during a general information meeting.
Our impression, because, as investigators, we are highly observant during an investigation, was that the subject was confident, almost smug, that nothing would be found on the device. It was a red flag to us.
The computer forensic specialist handled the computer investigation and the forensic data recovery came up with nothing incriminating. However, the computer forensic investigators were not satisfied. There may be some data in the system that provides some interesting information.
One is how many times the hard drive has been turned on and the other is how many hours it has been used. This data is part of the Self-Monitoring Analysis Reporting Tool (SMART), which was developed as a way to assess the physical “health” of the drive.
To a computer forensic investigator and a case, this information can also indicate whether a hard drive has been taken out and replaced.
That is exactly what had happened in this case. The accused was being smug because the hard drive that was in place when the emails were sent was not the same hard drive in the device when he turned it over to the computer forensics investigators.
He wasn’t quite as smug when confronted about the original hard drive. While the email evidence was not available, he admitted he had changed the drive and that implicated him in sending the emails.
-T. Wilcox, CEO, International Investigators