Often as a Forensics Expert, I find myself doing an investigation for a client where unfortunately critical information has been lost or the evidentiary value of the data has been compromised.
For a successful forensics investigation, the expert has to be able to assure that:
1. The data has not been changed or tampered with and is preserved in its original state.
2. Proper procedures are followed in gathering the evidence.
3. The opinions and findings can be based on solid information.
When you are victim of employee malfeasance or theft, your first reaction is to sit down at the offender’s computer and start digging for information. After all, most business owners are accustomed to taking charge and getting a handle on the situation. Unfortunately, where digital evidence is concerned, this is where good information gets lost or spoiled.
Often accusations get passed back and forth during the process. Evidence planting by the employer, the accused persons’ enemies in an organization, or other explanations are often given to explain away the information that is discovered. Therefore it is important that you as a business owner secure the information as quickly as possible.
If you have retained a forensics’ expert in the past, call them right away and have them walk you through the proper procedure in securing the evidence. If no one is available, or you don’t know who to call, at least consider taking the following steps:
1. Turn off the computer immediately by shutting off the power. When a computer goes through its shutdown process, it can overwrite information that could be valuable. However, if there is valuable information on the screen that may or may not have been saved to the computer hard drive, you will have to leave it on.
2. Take the computer to a secure location, and lock it away in a location that only two people have access. Make sure a log is kept of whom accesses the location of the computer. If you had to leave the computer on, secure the room/area where it is until a forensic’s expert can arrive.
3. Check around the area for CDs, USB Drives, or other portable media and lock it away with the computer.
4. Do not use the computer in any way shape or form until the hard drive has been properly imaged.
Taking a step back and slowing things down can save good information that will be invaluable during future civil and or criminal proceedings.
