eDiscovery and Digital Forensics – 2 Short Case Studies

We have received requests for examples of our eDiscovery and Digital Forensics projects that help in explaining the difference between the two departments. Here are a couple case studies that illustrate the different services we offer.

eDiscovery

Case: A corporation with over 5,000 employees sued 3 former employees for allegedly stealing and emailing trade secrets to a competitor.

Challenge: DriveSavers was shipped four external hard drives containing 14TB of compressed email backups from an Exchange server. The customer needed emails from the three former employees, including any attached files that were sent and received during a specific period of time, concerning specific topics. Turn around time required was one week from receipt of the data. The project had to be performed in a repeatable and legally defensible manner.

Solution: DriveSavers uncompressed and made a write blocked image of 14TB of data. The data was imported into a powerful eDiscovery platform. Keyword and date parameters were used to identify pertinent data, and emails were organized by user and email strings. The Client saved thousands of dollars in attorney fees when DriveSavers successfully reduced the amount of data for their attorneys to review from 4TB to only 25GB.

Summary: DriveSavers performed an eDiscovery service by identifying 25GB of pertinent data within 14TB of total data provided.

Digital Forensics

Case: A husband and wife were divorcing after twenty-five years of marriage. The most important issue in the case was the valuation of a jointly owned business. One spouse accused the other of modifying and deleting QuickBooks data. Attorney fees mounted as accusations were exchanged. This was a classic “he said, she said” scenario.

Challenge: A Forensic image had to be made of the work computer hard drive to allow logical and deleted QuickBooks data to be located and analyzed, without modifying data. The forensic image had to be in a form acceptable to courts and reviewable by other qualified forensic experts.

Solution: DriveSavers created a sector-by-sector forensic image of the entire drive. Allocated and unallocated space of the drive was searched for all QuickBooks data. The results were analyzed and all creation, modification and deletion dates were identified. DriveSavers issued a formal report on the forensic analysis. A DriveSaver Forensic Investigator was ready, willing and able to testify about the findings. The drive told the story, regardless of what he or she said.

Summary: DriveSavers performed a Digital Forensics service by finding pertinent data and then identifying the who, what, where, when of that data—who modified or deleted files, what files were affected and when these changes occurred.

Learn More

For more information call 800.440.1904.
You can also find out more about eDiscovery by clicking here and Digital Forensics by clicking here.