Rules of procedure involving computer forensics and evidence analysis:
The Federal Rules of Civil Procedure which became law on 12-1-2006, most attorneys are either unfamiliar and have not needed Computer Forensics and Electronic Evidence Discovery or are familiar with the Federal Rules of Civil Procedure, Rule 26, Rule 34, and Rule 45, which have added many new procedures for handling and requesting electronic information.
Computer Evidence Analysis Using Court Certified Forensic Tools
Utilizing court certified analysis tools including Guidance Software’s Encase and Access Data’s Forensic Toolkit (FTK), you can be assured your evidence will meet discovery demands and stand up in court.
The search parameters and keyword list of important terms, names and documents you provide regarding your case are analysed for matches, cataloged and presented in a final report for use by you or your attorney.
You say "Can’t my IT person or another employee look through the data"?
Absolutely NOT, every time the drive is turned on and accessed, data is being deleted and/or overwritten.
Let's say an employee departs your company, a few weeks later or less, you notice a drastic drop in sales and/or clients. Would you feel comfortable putting that person on the witness stand instead of a forensic specialist to try and explain what they looked at, what they found only to be asked to produce the device and then discover the evidence is inadmissible because the time and date stamps were changed?
To avoid this embarassing situtaion and the potential loss of your case it is vital that computer evidence is properly acquired, handled and analyzed.
To perform a computer forensic analysis, a forensics specialist will acquire and analyze the hard drive for evidence of communications with the departed employee about moving to the new company. They can also determine if files such as client lists were copied to removable media and/or e-mailed through a corporate or web-based (personal) e-mail.