2011 Spring & Winter Seminars - ACFLS (Association of Certified Family Law Specialists), San Diego, dates TBA

 

August 2011 - State Bar Annual Conference, Long Beach 

 

September 2011 - CAALA (Consumer Attorneys Association of Los Angeles), Las Vegas

 

October 2011 - CELA (California Employment Lawyers Association), Monterey

 

February 2012 - CACJ (California Attorneys for Criminal Justice), Monterey

 

Spring 2012 - NACDL (National Association of Criminal Defense Lawyers) Technology Seminar, Las Vegas

 

 

If you've never had to seize an employee's computer for evidence, chances are you will at some point in the future. For example, if you suspect internal fraud you may find that law enforcement will not get involved unless there is proof that a crime was committed. Seizing the employee's computer may be your only means to secure proof, and the validity of that proof rests on proper execution of seizure and computer forensic protocols.

Consider this actual case: An employee used a company computer to order products with company funds and then deleted the invoices after the products were paid for. The employee then deleted the product from inventory and deleted any trace that the products ever existed. The employee advertised the products for sale by competing (fake) businesses, all run fraudulently by the employee. The fake inventory was run on software which, once deleted, deleted the database; ergo, no evidence of the illegal activity.

However, several hard-copy invoices survived, which provided search criteria for the computer forensics examiner to work with. After searching the slack and unallocated space on the HDD (hard disk drive) DataChasers recovered deleted invoices which constituted enough evidence to prove that the merchandise had at one time existed within the company, was paid for with company funds, and had then "disappeared." Corroborating evidence resulted in substantial evidence of the fraud.

Why was it necessary to seize the employee's computer? Why not... Read More

I have received several queries concerning this since the subject started going around on a couple attorney listservs. It is very important, and worth the few minutes it takes to understand the difference between Metadata and Track Changes and how to rid a document of both.

TRACK CHANGES

Track Changes is an MS (Microsoft) Word markup tool that is potentially very damaging to an attorney's practice. Track Changes does just what the name suggests; it tracks changes, comments, and revisions made throughout the life of the document. For example, a brief that is edited by several attorneys will contain each attorney's edit and any comments they attached as a margin balloon on the document. At the least, this information could be embarrassing; at the worst it could... Read More 

DataChasers® provides the legal community full-service forensic computer and e-Discovery investigations. When you choose DataChasers®, you choose experienced examiners, holding multiple certifications, providing personal attention to the individual needs of your case. We are well-versed in the litigation process and offer experienced litigation support services. Our examiners are recognized expert witnesses and court-appointed neutrals who have taught computer forensics, lectured extensively, and published numerous articles on the subject. ...Read More

Our Mission:

Focus on the client's needs; exceed expectations; do the right thing. This is our reputation. We believe it is the most important thing we offer our clients, followed by our experience, certifications, and background. We help you learn the truth, eliminate surprises and win more cases.