News & Computer Forensics Blog
Author Jon Berryhill
Computer Forensics Investigative Expert and Certified Expert Witness for Military, State and Federal Courts
 By Jon Berryhill
So what is a digital forensic analysis? The short answer is – it depends…. Every case and situation is different. Recently I was talking to someone who had retained the services of a company to conduct an analysis of a laptop. The customer had a fairly simple question he was trying to answer: “Is there evidence that the user of the machine was engaging in the suspected inappropriate communications and/or activity?”. What the customer got back was a several hundred page “report” of “preliminary findings” and was told that was their “phase one” analysis. In order to get more information or even an explanation of the provided report, the customer would have to pay for the “phase two” analysis. The additional cost was tiered depending on how quickly the work would be done with the “standard” (lowest cost) option having a 60-day turnaround. Needless to say the cost of a much more reasonable turnaround time made me gag. A proper analysis means doing whatever data processing and analysis is necessary to answer the pertinent questions for the specific case. This usually means putting together the pieces of the puzzle from many different sources to put together a logical and relevant conclusion. Most digital forensic analysis software packages (like EnCase, FTK and others), can generate an automated “report.” With little or no input from the analyst, the scripts that generate these reports can produces hundreds of pages of information. Seldom do these reports contain anything meaningful or understandable to a customer. When an analyst dumps one of these automated reports on a client, especially when accompanied by a bill, it is usually done for what I call the “thud effect” (how loud a sound can you make when you drop the report on a table in an effort to make it appear you have done a lot of work?). Did all that work and the trees they killed producing it provide answers? Did the analyst explain the findings?
3 Comments
Author: Jon BerryhillWrite something about yourself. No need to be fancy, just an overview.  What if opposing counsel informs you they’re calling a computer forensics analyst as an expert? Even if you don’t need an expert to analyze computer data, it can pay to have one in your hip pocket.
Computer forensics and eDiscovery can involve computers belonging to your client and/or the opposing side. If there were computer evidence (or the potential for evidence) germane to a case, you would be best served to have an experienced computer forensics analyst look at the data. A computer forensics expert can work as a special master or can sign a non-disclosure agreement in order to protect confidential information. If opposing counsel hires an expert, you will want to have their analysis and conclusions reviewed by your own expert. Occasionally, opposing counsel will share the imaged (copied) hard drives from computers involved in the discovery. If you are deposing opposing counsel’s computer forensics expert, it can be extremely valuable to have your own expert in attendance. Often, they can identify flaws in the other expert’s answers, or suggest a line of questioning. We recently provided this service to a client. During the depositions, the other side’s experts essentially refuted much of what was in their own analysis. Before the case ever went to trial, opposing counsel had withdrawn its computer forensics experts. Have you ever considered acting as your own computer forensics expert? A few years ago, a defense attorney contacted our company and asked to rent (use) our forensics equipment to view and analyze a hard drive image of his client’s computer made by investigators. As experienced professional computer forensic experts, we were concerned about this request, and offered our analysis services, which this defense attorney declined. The attorney paid for the use of our equipment, and until recently, we had not heard what became of the case. Unfortunately for his client, this attorney lost the case. His client spent the next few years in jail as a result. We were approached on this case after the client had secured a new attorney to handle an appeal. The original trial judge provided a declaration expressing his opinion that the defendant had been poorly represented. Our company was the only other party asked to provide a declaration, which we did, stating our professional opinion that the computer forensics evidence was incomplete and not conclusive. Perhaps if the attorney had not tried to act as his own expert, his client might have been spared prison time. |