By Jon Berryhill

​Recently our firm was brought into a case where the opposing counsel had retained a computer forensic expert. After the work was complete, questions began to surface regarding the quality of the work and the value received for the cost.

During the initial telephone call, information regarding this "expert's" work process and work product started to raise giant red flags for us. We went to the location where the computer forensics "expert" had gathered evidence. We counted the computers, noted the size of the hard drives, and analyzed the scope of work.

Since that initial phone call, what we discovered has been rather alarming: exaggerated fees, unsupported conclusions, exaggerated hours per task, opinions not supported by the facts, and the list goes on!

Ultimately, this "expert" billed over $100,000 for computer forensics services that should have required about 10–20 hours of work. While their hourly rates were within the average range for the industry, they pumped up the amount of time and the number of employees required to complete the job.
​
To protect your firm from being fleeced by a computer forensics "expert," read Hiring A Computer Expert - Don't Get Fleeced! As a bonus, we have included a standard chart of typical or common computer forensic services, and corresponding amounts of time usually needed to complete each task.
If you are involved in a case in which a computer forensics firm has been hired by opposing counsel, give us a call. Protect your clients and your firm's reputation; don't allow shoddy computer forensics work to damage your case.

What if opposing counsel informs you they’re calling a computer forensics analyst as an expert? Even if you don’t need an expert to analyze computer data, it can pay to have one in your hip pocket.

Computer forensics and eDiscovery can involve computers belonging to your client and/or the opposing side. If there were computer evidence (or the potential for evidence) germane to a case, you would be best served to have an experienced computer forensics analyst look at the data. A computer forensics expert can work as a special master or can sign a non-disclosure agreement in order to protect confidential information. If opposing counsel hires an expert, you will want to have their analysis and conclusions reviewed by your own expert. Occasionally, opposing counsel will share the imaged (copied) hard drives from computers involved in the discovery.

If you are deposing opposing counsel’s computer forensics expert, it can be extremely valuable to have your own expert in attendance. Often, they can identify flaws in the other expert’s answers, or suggest a line of questioning. We recently provided this service to a client. During the depositions, the other side’s experts essentially refuted much of what was in their own analysis. Before the case ever went to trial, opposing counsel had withdrawn its computer forensics experts.

Have you ever considered acting as your own computer forensics expert? A few years ago, a defense attorney contacted our company and asked to rent (use) our forensics equipment to view and analyze a hard drive image of his client’s computer made by investigators. As experienced professional computer forensic experts, we were concerned about this request, and offered our analysis services, which this defense attorney declined. The attorney paid for the use of our equipment, and until recently, we had not heard what became of the case.

Unfortunately for his client, this attorney lost the case. His client spent the next few years in jail as a result. We were approached on this case after the client had secured a new attorney to handle an appeal. The original trial judge provided a declaration expressing his opinion that the defendant had been poorly represented. Our company was the only other party asked to provide a declaration, which we did, stating our professional opinion that the computer forensics evidence was incomplete and not conclusive. Perhaps if the attorney had not tried to act as his own expert, his client might have been spared prison time.