The very first stages of an investigation offer critical opportunities for forming a strong working relationship with counsel and establishing a strong foundation upon which a successful investigation can be built. Failure to take advantage of these opportunities will almost assuredly spell disaster and much heartache.
By understanding the essential facts of a case, as well as the legal objectives of the investigation or litigation, an examiner is able to become a strategic partner with counsel rather than just blindly digging out ones and zeroes in a vacuum.
Not only will this contribute to designing a focused, cost-effective examination plan, but the examiner will also understand how her work fits within counsel’s strategies, ensuring that critical evidence isn’t overlooked and allowing for more persuasive work product tailored to counsel’s needs. (How can I make him look good?)
In addition, it also provides an opportunity for the examiner to identify and suggest possibilities in which the digital evidence may yield benefits in the case beyond what counsel was initially envisioning.
It is fairly common for counsel to call us with a very limited purpose in mind with respect to how the digital evidence might be of benefit in their case. They are not aware of the ins and outs of computer forensics and the potential nuggets of gold that may lie within the digital evidence, and where else they may benefit their case.
In learning the facts and legal objectives in play, you will often be able to identify other possibilities for how the digital evidence could be helpful that counsel had not even considered. In the process you will be making yourself a valuable partner and making him look good!
Sergio Acosta, former Chief of the General Crimes Section of the U.S. Attorney’s Office in Chicago, and current Hinshaw and Culbertson partner, shared his take on what works best here, “I’d say expressing a genuine interest in the facts and nature of the case is a big positive. As a former prosecutor, I still have that investigative team mentality. I have been most impressed with forensic examiners who exhibit a teamwork attitude and approach..."
Project planning: A clear, focused, yet thorough plan with reliable time and cost expectation
You must take the lead in identifying how, through your examination and investigation, you can help counsel in taking on the issues that they are facing. In most instances, you cannot just passively sit back and leave counsel to try to design and direct your work.
Very few attorneys know enough about the possibilities and limitations of computer forensics. That’s why they’ve called you! Here again is a golden opportunity to make them look good by listening to the facts and strategies of their case, and offering a thorough, yet focused, forensic investigation plan.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.