Most technical investigations include the receipt, evaluation, and analysis of electronic information stored and managed in "server" based environments.  While there is a significant amount of information maintained on local personal computers, information housed on servers is becoming more and more relevant to investigations related to regulatory and enforcement cases.

There is a significant difference between computer forensics and electronic document forensics.  This difference primarily is noted when the desired/requested information resides on a corporate, or network, server or enterprise wide system or application such as those that are considered one of the foundational technologies of document management.  These core technologies typically include document imaging, OCR/ICR, Forms and forms management, document services, and workflow.

As such, when conducting this type of technical investigation, it is important that basic investigative techniques are followed AND that the investigative team have an in-depth understanding of the various electronic data storage/management applications, systems, and technologies.  This is becoming increasingly important as more and more investigations are requesting and reviewing information from network based email systems, document imaging systems, optical storage technologies, document services components, and workflow systems.  These technologies provide significant challenges to regulators and enforcement personnel due to the significant differences in what type of information is maintained, how the data is stored/managed, logs, audit trails, along how these technologies differ from the more common standalone email programs and local hard-drive evaluation.  

EID has in-depth experience and knowledge in working with these technologies AND has personnel with direct law enforcement experience assuring that the investigation will be thorough and complete.  Additionally, EID has personnel who are considered technical experts with these technologies and are considered technology experts and industry analysts.  This breadth of experience enables the EID team to identify what type, and level, of analysis is required along with being able to perform the investigation in a thorough and detailed fashion.

EID assists investigative agencies who require additional technical, investigative, and/or consulting services including:

• Assisting the department/agency in conducting interviews and interfacing with the IT personnel to determine the most appropriate format of data and the determination of the best storage location for the electronic information that will need to be mined.

• Assistance securing electronic information received by the department/agency in an environment where there is no chance of unauthorized access

• Providing analysis of the information received to ensure compliance with any information requests or subpoenas issued by the department

• Assuming responsibility for developing analytical spreadsheets following basic investigative procedures and techniques.

• Providing detailed data and pattern analysis of the received information

• Providing expert industry/technology guidance and information related to the various technologies including current optical storage environments.

EID is familiar with handling subpoenas, discovery orders and other information requests issued by regulatory agencies.  EID works closely with the client to evaluate requested/received technical information including comparing received records, and data, to the issued information requests/subpoenas, to assist in determining compliance, and performing a detailed analysis of the data.  As a result EID can assist in technical investigations ensuring a thorough and complete evaluation and review/analysis of the electronic information.