Forensics
Discovery Specialists provides forensics services internally and through our expert witness partners who have extensive experience testifying in litigations. We provide a full spectrum of forensic services including: data recovery, password unlocking, re-creation of meta-data, tracking the path a document has taken through a network, or examination of out-dated technology.
Data recovery
Data recovery is important in two contexts. First, our own client or a third party witness may have storage devices that have crashed and contain important evidence that would help our client. We can help recover this lost data, or at least parts of this data and provide verification of the processes used. The second common use for data recovery is when evidence is received from the Opposition. We have had cases where physical evidence was received for inspection where important files had been deleted from the external hard drives and recovered by our technicians. In the same manner, the Opposition has claimed in the past on cases that evidence could not be produced because it was lost due to a storage malfunction or the company’s retention policy. Whether the data is damaged, deleted, or simply lost on a system, Discovery Specialists can help recover the evidence.
Password Unlocking
Most productions received from our client or the Opposition contain password protected compressed files or documents. In many cases, the password protected documents were created several years previously and even the person that created the password can no longer remember it. Unfortunately, the underlying documents may not exist anywhere else in an non-password protected version. Discovery Specialists has a range of tools that we use to quickly and automatically unlock these documents for further review in the discovery process.
Extraction of Metadata
Metadata is found in every document created. This is information that is not usually visible to the user, but contains identification information on how the document was created, when it was created, whom it was created by, and many other important specifications on the document that may be important depending on the case. Discovery Specialists can pull this metadata from native documents and populate tables in the attorney review database to quick sort, search, and filter documents based on this data. On example is on email. We can create a flag in the attorney review database marking which emails were recorded as being READ by the custodian. This could be important in case where a deponent is claiming that even if an email was received, there is no evidence that they actually ever read it. Another common use of metadata is detecting early versions and changes in a document that have been preserved in the metadata. By extracting this information, important information can be learned about a company’s previous thoughts or actions on a subject.
Tracking the Path a Document Has Taken Through a Network
When a document is copied or transferred through email often there are “fingerprints” that are left on the document. Discovery Specialists can help detect these fingerprints and find where a document has been. In those cases, by analyzing a document across an entire production, Discovery Specialists can form a roadmap of when this document was created, updated, and transferred through a company, along with who authored the documents and who sent and received the document. This is important for use in depositions and understanding the change and approval process on a document.
Examination of Out-Dated Technology
With the speed of technology development, old software applications and hardware cannot be effectively maintained for review of old system data by companies. Our forensics services can take those old tapes, diskettes, and application data and unlock their potential without destroying or changing the data and evidentiary chain. Along with our in-depth knowledge of engineering systems and access to out-dated hardware and software, we can rebuild systems and customize solutions for any need. Our expert witness partners can be used in cases where declarations or depositions will be required to authenticate the evidence and steps taken to restore the documents.