Gear up, without shutting down.
Corporations today understand the importance of establishing a litigation readiness playbook. However, a plan is only as good as its execution. Strategic has a team of certified experts—in IT, forensics, eDiscovery technology and legal process management (LPM)—ready to assist with assessment or execution.
Strategic provides a LPM specialist to oversee the legal hold process—legal hold notification and correspondence tracking, custodian survey consultation, and status reporting—using industry-leading legal hold technology and close collaboration with your legal team.
Digital Forensics Collection & Filtering
With the volume of electronic data being generated and the multiple devices custodians are using to generate, transmit and archive their data, the process of data acquisition and preservation is becoming increasingly complex. Developing a collections and filtering protocol puts undue burden on your IT department and may compromise the validity and defensibility of the collection process. Strategic can provide a LPM specialist to oversee the entire process—including collections scheduling, status reporting and coordination of expert testimony—ensuring all data has been preserved and collected in a forensic and defensible manner.
Establishing Data Acquisition Protocol
We start with a thorough inventory to identify the custodians and devices relevant to the investigation. Once we understand your network architecture and backup technology and gather the necessary permissions, we’ll develop a data acquisition protocol and timeline. You’ll review and approve a data acquisition budget. A certified forensic examiner documents all acquisition protocol and maintains proper chain of custody documentation throughout the process. Forensic reports, affidavits and expert testimony will be available upon request.
Digital Forensic Data Acquisition Methods
Although on-site data acquisition is the most time- and cost-effective method of forensic imaging for computer workstations and personal devices, having a mobile forensic lab operating on-site during normal business hours may be disruptive. Remote acquisition provides an alternative to the traditional on-site data acquisition. We use a forensic collection device (FCD) programmed to auto-run and complete a full forensic image, making a bit-level copy of the device hard drive through a remote desktop session. A certified forensic examiner documents all acquisition protocol and maintains proper chain of custody documentation throughout the process.
Backup Tape Cataloging & Restoration
When the scope of the data acquisition exceeds the active data, backup tape cataloging and restoration may be necessary. Strategic’s forensic team adds efficiency and reduces time and expense by cataloging in advance of restoration to confirm the relevant custodian data resides on backup tape prior to completing the full restore.