Electronic Discovery & Forensics

Computer forensics allows data recovery that would not normally be obtainable - including from file deletions or formatting the hard drive. Electronic discovery allows modern information to be obtained and used cost-effectively. When using computerized information, involving us in the beginning allows more to be done – usually at a lower cost.

We are routinely involved with engagements that:

Recover documents that would not normally be recoverable - either from deletion or formatting the hard drive.
Crack passwords and un-encrypt protected documents.
Create internet usage history.
Extract financial data, electronic documents, and email.
Electronically search to identify desired information.
Uncovering electronic evidence that identifies inappropriate transactions/activities by employees.
Create timelines showing a user’s computer use.

Additional details of representative projects follow:

We created a forensic image of an Exchange e-mail server and extracted potentially privileged e-mails for review. We then compared a list of potentially privileged e-mail accounts to the entire population of e-mails and extracted only e-mails between privileged parties to limit the population of review records.
We performed a forensic examination of a company that lost numerous top executives and other employees to a major competitor. Fulcrum’s forensic analysis determined the extent of the former executives and employees conduct, including (i) using their employer’s resources to market themselves to the competitor, and (ii) removing proprietary information to obtain customers for the new employer.
We performed a forensic examination of an employee who left for a competitor and took customer lists with him. The examination showed the employee downloaded the customers into an easily transferable file from a central customer management database within two weeks of his departure. This customer information included critical sales history. Additional analysis of his sales at his new company showed that approximately 97% of his thousands of new customers matched to his former employer. Based on the strength of this evidence the Court granted summary judgment on liability issues for our client.
We performed a forensic examination on behalf of an enterprise that was investigating its Director of Information Technology for inappropriate use of his employer’s resources. We demonstrated that the IT director was creating and retaining copies of highly confidential records on his own external hard drive. There was no good reason for this activity and the employee was terminated.
We performed a forensic examination for a company accused of creating and using pirated software. The software in question utilizes a license file that is unique to each computer. Fulcrum identified cracked versions of the software on three separate client computers. However, we also demonstrated that (i) the software in question was not used on the subject computers and (ii) the individual at the company that informed the software company of the cracked licenses likely was responsible for installing the unauthorized software on the three computers.
On behalf of a major telecommunications company, proved that refunds granted to users on its network were legitimately tied to original calls. Our client was accused of generating phantom refunds in order to reduce the amount of money due to others. We matched over 4 million refunds to almost 20 million original call records. Many of the refund records did not have complete data. Several issues arose from the difference between the way the original call was recorded and the way the operators would enter refunds that made reconciliation difficult. We developed a process to match the records and overcome the various shortcomings in the data.
Statistically analyzed customer sales trends gathered from computerized customer tracking data. Collected and consolidated hundreds of gigabytes of sales history data.
Performed large scale data collection and analysis for a trust accounts involved in a class action lawsuit. We gathered account information for approximately 300,000 account holders going back over twenty years. We identified account holders with multiple aliases in the system to identify the unique class. We reconstructed account transaction history for select individuals going back over one hundred years based on paper records.
Managed the conversion of survey records for a class action lawsuit to an electronic database format. We developed the database, managed the data entry process, and performed quality control on the survey conversion. In addition, we prepared reports and summary information from the electronic survey database.
Collected accounting and operations data from a major clothing company. Converted the data from an AS400 mainframe database to Microsoft SQL Server for analysis. Audited the manufacturing and sales data and reconciled shipping records to accounting sales data.
Performed a computerized analysis of the sale of a major manufacturer accused of patent infringement. We calculated the value of sales for almost a decade of allegedly infringing products from a database of millions of transactions. We prepared a report showing limited infringing product sales and almost no value ascribed to the infringing technology.
Defended a client accused of false advertising by the only major competitor in the marketplace. We created a database of the sales from both companies in order to compare the trends from each company both prior to and during the damage period. We compared the customer lists for both companies to determine which customers migrated between the competitors and refuted the plaintiff’s claim that all migrating customers were the result of false advertising. We calculated the damages due to plaintiff that isolated the other factors that contributed to plaintiff’s alleged drop in sales growth.
Using substantial electronic data, quantified the amount of prescription drugs charged by a nationwide pharmacy to a major long-term care provider. We determined the amount overcharged for each prescription based on the contractual pricing arrangement between the two entities. We identified significant discrepancies between the contractual prices and the amounts actually charged. We calculated the amount due from the overcharges.
Developed a Microsoft SQL Server database and related online customer interface to track customer transactions, holdings, and elections that are held in a single master trust. This approach minimizes transaction costs and facilitates management. Customers access their accounts using a web-based interface.

Reference Articles

Go to E-Discovery and Computer Forensics Library

Special Masters

When databases, computer forensics, or other large collections of electronic information are at issue, discovery challenges can be best handled with hands-on assistance from a neutral party. Courts lack the time and technical capabilities to cost-effectively get the job done. We summarize the reasons why special masters can save money, and summarize the authority for their appointment.

Employee Investigations

Employers should be using computerized evidence as part of their proactive personnel decisions. Computers can provide information about user activities that otherwise might take months to confirm … but only if you look timely.

Reducing Costs Through Statistical Sampling

Reliance on Boolean key word searches to reduce volumes leaves some worried that key documents are not being produced. Statistical sampling provides a means of testing and quantifying whether the keyword selections provide a complete solution.

Computer Forensics Deserve A Place In Your Human Resource Toolkit

Electronic Storage and Retention Best Practices

Before the litigation starts, most companies could reduce their litigation costs by making different decisions regarding what, and how, electronic records are maintained. Here is advice regarding how to do this.

Assertion That Electronic Data Is "Not Reasonably Accessible" Must Be Supported

A recent case confirms that backup data was never automatically exempt from production. Parties need to justify why electronic data is not being produced. The defendant in this case could have avoided some adverse consequences if they followed the simple advice we provide. We also describe some misused labels in electronic discovery.

Getting the Electronic Discovery You Need

Since practically all business records are now computerized, it makes sense to learn about your opponent’s systems BEFORE you start to make requests. A corporate-representative deposition on electronic-discovery issues should be the very first discovery action you take. When done at the beginning of a case, senseless argument over what information exists and does not exist is avoided, because you then have the benefit of a party admission. We provide a list of records that you should be requesting in this initial deposition.

Key Electronic Case Law (Annotated)

Updated July 2006