• Home
• About Us
• Services
• Contact

SERVICES

We will typically customize our service offerings around our clients needs but the following information should give you a flavor of the types of services we offer.

For Attorneys

The December 2006 changes to the Federal Rules of Civil Procedure (FRCP) have highlighted the importance of electronically stored information (ESI). We help attorneys meet their obligations under the new rules by offering the following services:

• Identification of relevant sources of electronically stored information.
• Assistance in the preparation of tailored discovery requests related to electronic evidence.
• Evaluation and review of discovery responses.
• Review of discovery requests to protect our clients against overly broad demands.
• Acquisition and analysis of electronic evidence and presentation of findings. For more information see the "Computer Forensics" section below.
• Strategy guidance on topics related to electronic evidence.
• Expert witness testimony.
• In situations with potential privilege concerns we can serve as a neutral third party.

For Corporations

In the corporate realm incidents of employee misconduct including theft, harassment and misappropriation of trade secrets will more often than not involve an electronic component. When incidents of suspected employee misconduct arise it is important to immediately engage qualified, neutral investigatve expertise.

• After hours acquisition. In most cases of suspected employee misconduct an image of the employees computer will be acquired at night or over the weekend so as not to disrupt operations or arouse suspicions. The investigation can then proceed without alerting the employee.
• Image and Hold. When an employees relationship with a company comes to an end and there is a concern that legal action may ensue we recommend taking an exact copy (image) of the employees computer to preserve potential evidence. We will securely hold the evidence for a set period of time during which it will remain available for a computer forensics examination should the need arise. Once the time period has elapsed the image will be destroyed.
• Data Recovery. If critical data is lost we may be able to assist you in its recovery. We have the ability to recover various document formats, databases and multimedia content.

Computer Forensics

Each computer forensics investigation will have it's own unique set of requirements and constraints but the vast majority of investigations will consist of the following phases:

• Assessment: During this phase we will define the nature and scope of the electronic evidence we are interested in. We will need a thorough understanding of the target computing environment in order to determine where potential evidence might exist. Email for example may exist in multiple locations including users desktops, an email server or on backup tapes. It is important that we identify the likely sources of evidence before proceeding to the next phase.
• Acquisition: Maintaining the integrity of the original evidence is a critical aspect of the computer forensics process and it is for this reason that computer forensic examinations are typically conducted on a copy of the suspect hard drive(s). This is the acquisition phase of the computer forensics process (a.k.a. "imaging") and it results in an exact replica of the original evidence. During this phase a chain of custody will be established for the original evidence and the replicas as needed.
• Analysis: This is where we take the image obtained during the acquisition phase and use a variety of tools and specialized techniques to understand and interpret the evidence. Based on the scope of the investigation as defined in the assessment phase the analysis phase will typically consist of one or more of the following areas:
• Email analysis of both enterprise email systems such as Microsoft Exchange and Lotus Notes, and personal web based email accounts such as Yahoo!, AOL and HotMail.
• Reconstruction of web browsing history.
• Deleted Data Recovery.
• Document and application analysis.
• Construction of computer activity timelines.
• Keyword searching.
• Presentation of Findings: In addition to a report detailing procedures and findings all relevant evidence will be furnished in a format that is compatible with our clients systems.

When you partner with CFI: New England you can expect total professionalism, complete discretion and a superior work product.