HIRING A COMPUTER FORENSICS INVESTIGATOR

What is Possible?

Unfortunately, there is no easy answer. The bottom line is this. If it has been performed on the computer, and has not been overwritten by other data, it is recoverable by a skilled computer forensics specialist. From deleted emails, to websites visited, to decrypting documents, the sky is truly the limit. Even if a document has been partially overwritten by new data, we can extract the remaining portion.

Sometimes, more important than recovering documents is the ability to respond to a case where the user has used or attempted to use file wiping utilities to destroy evidence. Our skilled operators can detect such activity, and in many cases even show what had been wiped. Not to mention actually restoring files that were thought to have been permanently destroyed.

How do you choose?

When you require the services of a computer forensics investigator, don't be afraid to shop around. There are an increasing number of firms and individuals who claim to be computer forensics experts. Many charge rates in excess of ten thousand dollars for a single drive examined on a very ordinary case like a domestic matter.

Obviously the level of experience of the examiner is also crucial. There are really only a handful of top notch computer forensics investigators throughout North America. We advise that you request the Curriculum Vitae of the investigator to make sure he or she meets your requirements before you consider who to hire. There is far more to proper computer forensic analysis than the ability to retrieve data, especially when a case could go to court.

Computer forensic skill aside, ultimately you are retaining the services of a computer expert who will likely be called to testify in court to explain his or her work and findings. The court will want to acknowledge that individual's level of computer and investigative training and experience rather than the experience of the firm. That experience should come from computer forensics and real world investigation. The same would be true of his or her training. Obviously there are many individuals running around in North America equipped with computer forensics software who have no experience testifying, are not investigators and only know one way to search for data on a computer, and we affectionately refer to them as "button pushers".

Common Pitfalls In Hiring A Computer Forensics Investigator
Computer Forensic Experts
Some of the more common pitfalls that an attorney can encounter when hiring a computer forensics expert or other professional are easy to avoid and may save your case. Here are a few to keep in mind:

Waiting Until The Last Minute
Although when pressed, a computer forensics expert can often get the job done and be ready for a deposition or trial in two or three days, more often than not, problems can arise that will preclude us from doing the best that we can for you. Sooner is always better than later for a number of reasons. The best computer forensic investigator for the job may be booked up, he or she may also have personal scheduling conflicts, they may need to travel to get the job done and costs for that travel will obviously be higher, some experts charge more for rush assignments, the information that the computer forensics expert retrieves may yield far more places to look for other supporting evidence but you are out of time, etc., etc., etc.

Hiring The First Computer Forensic Expert Who Tells You Want You Want To Hear
There are many experts to choose from, but few are the right ones for your assignment. As with any business person, the forensic computer investigator knows how to sell her or his services. Computer forensics can be very complicated work, particularly in a network environment. If the answers seem too simple, move on. Be careful that they are the right expert and not just an expert with the right answers. Some important questions to ask include: Are they licensed private investigators or simply some guy with forensic software? (The latter knows how to run a search program but has little or no understanding or investigations and how to get you everything) What is their history in court? Who else do they work for? These and may more questions should be asked before a decision is made.

Hiring From The Low Cost Drawer
The lowest cost computer forensic expert is likely to make the worst expert. The reality about this work is that those who are truly qualified to help your client cannot offer their services for $2,000.00. To expend the time, energy and resources needed to do even the simplest computer forensics, it is not possible to run a profitable computer forensics practice and charge rates that low. If the expert is a good one, they will know that they are worth more. True experts do not “discount” their fees.

Giving Your Expert Vague Information
Providing your computer forensics expert with all of the information they need to conduct a complete, accurate and thorough investigation is a must. Anything less, despite the excuse, will certainly put your client’s case at risk. If for some reason you do not have access to everything you need, let your forensics expert know ahead of time. One of the worst things you can do is hide information from your expert just because it doesn't support your theory. When aware of everything, the computer forensics investigator can be prepared and honest without accidentally taking you down the wrong path.

Create An Off-The-Wall Theory And Ask The Computer Forensic Investigator To Back It Up
Not only are most of our findings very black and white, we are experts and labeled as such for a reason. It is unlikely that any reputable expert will agree to endorse something unorthodox or illicit. We undergo extensive training not only to become experts but also in investigative ethics. If we tell you that your theory is not supportable, please respect our expertise. Once we give you the evidence found on a hard drive or other storage media, you can form a defensible legal theory that will work.