The case for digital forensics

Listen to this article

When to invest in e-discovery’s deeper-probing cousin

Digital forensics has become such a part of Timothy Edwards’ practice that he makes sure to have an analyst next to him during depositions.

“They’ve helped me formulate strategy. When I have them on my side and I’m using the advice that they give me, I am a 10 times better lawyer,” said Edwards, an attorney with Cullen Weston Pines & Bach LLP, Madison, and former chair of the electronic discovery and records management team at Axley Brynelson LLP, Madison.

A forensic investigator can point out potential evidence, and ways of procuring it, that Edwards never imagined, he said.

“They can literally dictate the outcome of a case,” he said. “No question about it.”

That’s why he’s tailored his discovery plan to include the possibility of digital analysis and he makes room at the table for a forensic analyst.

“They are part of the process,” Edwards said, “and if the discovery plan you have is pointed toward that possibility, then you’re going to be a much more powerful advocate from a discovery perspective.”

Doug Elrick, director of forensic services at New Berlin-based Digital Intelligence Inc., said the firm’s investigators routinely work with public and private attorneys on cases involving fraud, child pornography and all sorts of civil matters, particularly when there are allegations of document destruction. Analysts even work in the private sector, he said, helping corporations determine whether an employee slipped away with proprietary information before joining a competitor.

“That’s actually one of our most common types of forensic exams,” said Elrick, a former forensic scientist for the Iowa Division of Criminal Investigation.

Where to start

For many attorneys, collaborating with an analyst starts with a bit of education, usually learning to distinguish forensics from its computer-based cousin, e-discovery.

“Forensics is looking for the needle in the haystack, whereas e-discovery is more trying to manage the haystack,” Elrick explained. “With e-discovery, we’re not necessarily looking for one single document or a smoking gun, although we’re using a lot of the same methodology.”

Forensics goes deeper than e-discovery, he said.

“It’s the autopsy of the computer system,” Elrick said. “We’re going back and looking at what occurred on the computer system, we’re doing a post-mortem analysis: not only is that history there, but when was it last opened, when was it last printed, who used it last, who made alterations?”

Even for attorneys as conversant in e-discovery as Edwards, that information, and the lines of questioning that come out of it, can be invaluable, he said.

“We can make allegations and point fingers about e-discovery all day, but they’re just allegations,” Edwards said. “A forensic expert could look at what was destroyed and whether [those documents] can be reassembled.”

In criminal cases, forensic analysts serve another function, often working with the prosecution and the defense, particularly in child exploitation and pornography cases.

“You’re helping the attorneys determine what type of media,” Elrick said. “Is it just pictures? Is it video? Was it files that were downloaded? Were they generated? Was the suspect creating his own? Were there more victims?”

That information could lead to an exoneration, as in the case of an accidental download, or it could lead to more charges, as was the case in a fraud investigation Elrick once led.

In that case, Elrick said, suspects were accused of scanning company logos out of the phone book and fabricating payroll checks with the images. A savvy clerk helped authorities catch the culprits but digital forensic analysts helped authorities crack the case wide open.

“Going through the computer system,” Elrick said, “we were able to find 20 or 25 other cities they had hit.”

The more you know

Some attorneys are uncomfortable with the idea of relying on outside help for something as essential as discovery, but both Edwards and Elrick emphasized the relationship should be viewed more as a partnership.

“The attorneys can’t be expected to know every technical aspect, just like we can’t be expected to know every aspect of the law,” he said.

Still, there are options for attorneys who seek a more informed collaboration.

At Madison Area Technical College, students can get a certificate in digital forensics that prepares them to not only analyze and obtain evidence, but also testify about their findings. The seven-course program includes instruction about ethics and concludes with a masters-level practicum, which involves not only finding evidence, but building a case based on that evidence and sharing that information in court.

“This isn’t for the faint of heart,” warned Tim Krueger, the program’s director and a full-time village administrator and police chief for the village of Maple Bluff.

Students need a solid foundation in computers. And they need time, usually about 18 months, to complete the program, which involves hands-on study in the college’s specialized computer lab.

So far, students mainly have been IT professionals from private sector companies. But, Krueger said, the program certainly could apply to attorneys.

Edwards, who has taught at the University of Wisconsin Law School, agreed. He said he not only would consider getting the certificate, but also would support exploring a collaboration between the law school and the technical college.

For those in search of a less formal education, Elrick said webinars from vendors, such as Guidance Software, allow attorneys to study based on their needs and schedules. Local providers also offer lunch-and-learn sessions, which could cover CLE credits, including for ethics.

The right partner

If an attorney does decide to team up with an analyst, Elrick said there is no agreed upon standard for certification. But he suggested looking for investigators certified through the International Association of Computer Investigative Specialists.

Attorneys also should be prepared for some sticker shock, he said, even though the industry has backed away from the inflated rates vendors once demanded. Though costs are “becoming more reasonable,” Elrick said, “For a while, a lot of the discovery firms were being pretty ridiculous in terms of what they were charging.”

Even for Edwards, who has styled his practice to account for digital forensics, the decision often comes down to cost, he said.

“It’s a challenge to balance the need for a digital forensic expert against the cost,” Edwards said, “because not everybody is rich.”

But, if a case relies on determining whether records have been erased, or recovering documents that have been deleted or lost, a digital investigator can be well worth the expense, he said.

“You’re recreating what has been destroyed,” Edwards said. “You’re putting Humpty Dumpty back together again.”