Back to Newsletter Archive

May 2014 ~ Volume 5

Digital Forensics isn't CSI, but it is Important in Many Court Cases

Digital forensics is NOT what you see on CSI.

You can't power up a computer with potential evidence and justITForensics-150x150 (1) go exploring - that could potentially prevent the evidence's admissibility in court (attorneys should remind their clients of this).

You also can't expect results in under an hour and finally, Sword & Shield Director of Computer Forensics and Security Assessments Bill Dean says most digital forensics experts are not nearly as attractive as the people on television.

"Digital forensics is the ability to obtain a great deal of information related to activities performed on computers," Dean said. "Digital forensics can often provide information that may otherwise be unavailable. This can include deleted information, Internet activities, social network usage, portable device usage, the ever-popular deleted text messages and detailed timeline activity of actions taken on a computer."

While most companies would rather not consider the possibility they could end up in court, the value of digital forensics can uncover intellectual property/trade secret theft, harassment, insider threats and computer intrusions, in addition to data important in other legal cases, such as divorce cases.

For example, after the former employee of a manufacturing company began working for a competitor, the manufacturing companys current employees noticed that their unreleased product designs were being marketed and sold by their competitor, leading them to believe they had been a victim of intellectual property theft.

The company contacted Sword & Shield to perform a forensic investigation on the laptop of the former employee. After a full forensic analysis of the hard drive, Sword & Shield analysts were able to identify the previous existence of a PowerPoint presentation that contained the product designs of interest and the associated marketing plans.

intellectual-property-theftSword & Shield concluded that the PowerPoint presentation in question was located on a USB drive that was not owned by our client. Sword & Shield analysts provided the serial number and the model number of the USB drive as the proof our client needed to subpoena the USB drive for analysis.

Upon analysis of the USB drive, Sword & Shield concluded that the former employee did, in fact, have the confidential information in his/her possession and had attempted to delete the file prior to providing the USB drive for examination.

Dean said Sword & Shield analyzes a wide variety of devices to solve the issues of our clients, including computers, laptops, mobile devices, tablets, portable media, servers, network equipment and CCTV systems.

For more information about Sword & Shield's forensics investigations, please call us at 865-244-3500 or email

Back to top