Protect Your Law Firm or Business From Being Fleeced By A Computer Forensics Expert

You need to take precautions and proactively protect your clients and law firm or business from being fleeced by a computer forensics "expert.” The information you get from an expert may need to stand up under the watchful, critical (and not necessarily technically savvy) eyes of the judge, opposing counsel, opposing expert, and the jury.

At first glance, a computer forensics expert may pass your litmus test of being competitively priced with hourly billing rates. However, there may be a disastrous “quality deficiency” when comparing the end result in services performed, total hours billed, and evidence produced and sworn to as fact.
​
Addressing all of the areas in a one-page at-a-glance overview is not possible. However, providing you with a quick reference chart and some critical pointers may save your firm and your clients from being fleeced by a computer geek passing their firm off as “experts” in the field!

Step 1

Ask for and check professional references. (Call and actually talk to the references!)

1. Question: Were you happy with their work?
2. Question: Would you hire them again? Why? Why not?
3. Have you worked with other computer forensics experts? Who? When?
4. How does this expert compare to your previous computer forensics expert?
5. How did this expert and their work product impact your case? ​

Step 2

Ask for a rate sheet, average time to complete tasks, or a range of time to complete each task. Some experts will use a standard flat rate for common tasks, which is also reasonable. 

Common Computer Forensics Tasks	Approximate Time Required*
1. Forensic quality image of hard drive	40 – 200 minutes per 100 GB (depending on size and age of hard drive)
2. Duplicate set of hard drive image files (a copy of the raw material)	30-60 minutes per 100 GB
3. Keyword search of image	1-4 hours for 10 keywords on a 100 GB drive (varies based on size of drive, how full the drive is, and number of keywords, and does not include time required to analyze hits)
4. Extract active files, recover deleted files, create file listing, and provide copy on optical or magnetic media	1-2 hours

* These are approximate times. Many variables can affect these tasks, but if you’re dealing with a healthy drive, the time should not vary from these ranges too much.