Internal Investigations, Audits, and more…

Electronic discovery is a process that many have associated with litigation, but eDiscovery is a part of several other use cases these days, including internal investigations, audits, Data Subject Access Requests (DSARs) from individual data subjects for which your organization may possess personal data and HSR second requests to address potential antitrust concerns from the Federal Trade Commission (FTC) in a merger or acquisition. Just about any organization these days has a need to conduct eDiscovery at some point to support one of these use cases, or even other more specialized ones.

While digital forensics isn’t needed in every use case requiring eDiscovery, it can be needed more often than you might think. Here are three reasons you might need digital forensics services by a certified forensic examiner in terms of what you might say when you realize you need those services:

“Oh snap! Somebody’s hiding something!”

In this recent post, “We’re Big Fans of This Case Law Ruling” and also “The Biggest Threat to Your Company May be within Your Company”, we discussed how the biggest threat to your company may be within your company in the form of current or former employees that may be involved in fraudulent activity that impacts your company. Whether it’s misappropriation of trade secrets, harassment, illegal activities or other types of fraudulent activity, it’s important to obtain the evidence to take appropriate action with the current or former employee (including firing them, filing a lawsuit against them, or reporting their activity to the authorities). Digital forensics may also be necessary to request for opposing parties in litigation if you find (and can demonstrate) that they are withholding relevant ESI in discovery (as this case illustrates).

Of course, you can expect that many parties that are trying to hide something will try to cover their tracks, but the evidence of those activities (and often the data they attempt to delete that illustrates the fraudulent activity) can be recovered through digital forensics.

“Oh crap! We accidentally deleted some data!”

Sometimes, deletion of data isn’t intentional or done to hide fraudulent activity. Sometimes, it’s merely a mistake that is made without any intent to delete data deemed to be important. Most of us at one time or another probably have deleted data from our laptops, network drives, cloud systems and/or mobile devices by accident, whether that deleted data is subject to a discovery request or not. Mistakes happen.

If that data is extremely important to your organization to respond to a discovery request – or just business operations in general – the good news is that data “deleted” is often not truly deleted. It may be recoverable through digital forensics.

Even if it’s not completely recoverable, it may be worth the effort to recover what you can, especially to refute claims by an opposing party of intent to deprive the party of that data. Determinations of intent have often been subjective by the courts, but good faith efforts to recover that data will help you refute any arguments of intentional deletion.

“Oh boy! We may need to provide an expert to testify”

Even when there is no potential fraud to investigate or effort needed on your part to recover data accidentally deleted, there may still be cases where you need digital forensics services. The most common reason is when you need an expert to testify as to the process you took during eDiscovery to ensure data authentication.

In many cases – especially highly contentious cases – having the ability for a certified forensic examiner to testify on your behalf regarding your process to ensure preservation and authentication of your organization’s data in discovery could mean the difference between inclusion or exclusion of that data, which (in turn) could mean the difference between winning and losing the case (or at least obtaining a favorable settlement).

Conclusion

Digital forensics services aren’t needed in all cases, but they are probably needed in more cases than you might realize. If you suspect someone is attempting to hide data, or that you have inadvertently deleted within your organization, or that you expect that you might need to provide a certified expert to testify as to your data preservation, collection and authentication processes, it’s best to get your certified forensics examiner involved as soon as possible. Wait too long and it could be too late for them to help you, in which case, you might be saying “Oh ****, why didn’t we contact them sooner”!