Computer Forensics

icon
Collections

Without a sound forensic collection, critical electronic evidence may be missed, inadvertently altered or otherwise rendered inadmissible. This can expose your business to legal complications, unreliable evidence, financial loss and/or reputational damage. KLDiscovery’s digital forensics experts understand the importance of their role performing data collections and do not take that obligation lightly. Whether it be for a small matter (collection of data from a single device) or a large corporate investigation (involving multiple custodians and data sources), in-person or remote, KLDiscovery will help determine the most defensible, efficient and cost-effective strategy.

icon
Remote Collection Manager (RCMgr®)

KLDiscovery’s RCMgr is the most comprehensive self-collection suite in eDiscovery. End-users and IT professionals alike can now easily perform forensically-sound collections of hard drives, loose files and email servers – effortlessly and defensibly. RCMgr drives arrive pre-configured to collect only the data you have defined. RCMgr logs the entire collection in granular detail, ensuring that our forensics experts can track the process from start to finish. Upon completion of the collection, RCMgr verifies and encrypts the collected data for secure shipment back to our lab. Packed full of features typically only available to expert on-site collection experts, RCMgr works on your schedule. Have a question at 3:00 a.m.? No problem. All RCMgr devices come with 24/7/365 support from KLDiscovery’s certified forensics analysts.

Wherever electronic equipment is used, there is a potential source of electronic evidence and digital information, including a “bread crumb” trail to illuminate misuse or wrongdoing. Our computer forensics experts help extract critical evidence, recover any data that culprits may have sought to erase or hide, retrieve key data buried in documents and organize data contained in multiple information sources to give our clients the insight and knowledge they need.

A forensic investigation may be undertaken on a wide range of media (if it stores data, it can potentially be investigated). Many of the most commonly encountered locations include hard drives, servers, mobile phones, tablets, cloud storage, back-up media, social media and individual electronic documents (photos, spreadsheets, etc.).

Our forensics experts employ the most modern and standardized techniques to carefully and accurately identify, preserve and extract critical evidence. This includes the implementation of a strict “chain of custody” procedure, audit trail and adherence to all region-specific evidence handling procedures throughout the handling of the data.

While there is no typical forensic investigation, each will have unique characteristics, scenarios we have experience in include:

• Commercial disputes
• IP or data theft cases
• Employment disputes
• External breaches or intrusion
• Computer misuse
• Harassment or bullying
• Fraud
• Criminal investigations

• Deleted file recovery
• Internet search and browsing history activity
• Windows registry analysis
• External media activity
• Last accessed, modified or created dates and files
• Webmail recovery

• Evidence of cloud-based storage
• Evidence of wiping utilities or file destruction
• Cross-validation of opposing expert reports
• Password cracking
• Chat, text and other on-demand/mobile communication history