Digital Forensics
E-Discovery
Data Breach
ArcherHall is a leading provider of computer forensics and e-discovery services for businesses and law firms nationwide.
Want to host a free MCLE presentation for your firm or legal association?
Case Studies
Digital Forensics
Client and Sales Data in
Snapchat and MurderClient and Sales Data in Employment Dispute
Deep retrieval of data from inactive CRM
Our client was being sued by one of their former employees. To defend against the claim, they needed to retrieve data from the oldest available backup of their inactive customer relationship management (CRM) system. The company required data from the backup to demonstrate the employee’s performance as evidenced by his activity within the system.
Client: Corporation
Categories: Digital Forensics
Snapchat and Murder
Meticulous analysis reveals critical cellphone evidence
A member of a notorious gang was found murdered in a small California city. Police had arrested a known associate of the gang (the Suspect) on grounds that cell phone towers showed his location at the crime scene during the given time window. The Suspect claimed that he did not commit the murder, but was at the crime scene. He identified another individual (the Defendant) as the murderer. The Defendant denied being at the crime scene, and denied being with the Suspect at any point during the day that the crime was admitted. The Defendant’s attorney hired ArcherHall to look through his cell phone for evidence pertaining to the crime.
Client: Defense Attorney
Categories: Digital Forensics
Malpractice Leads to Patient’s Death
Electronic Medical Record analysis uncovers records tampering
Our client, an attorney specializing in medical malpractice, hired ArcherHall for our experience analyzing electronic medical records (EMR) and presenting accurate timelines of patient care. The attorney was dealing with a case involving a physician who was accused of medical malpractice after their patient’s condition worsened significantly under their follow-up care. The attorney requested a copy of the patient’s electronic medical record from the physician, who presented him with paper documents. The attorney noticed inconsistencies in the dates of the records and suspected fabrication or tampering had occurred. ArcherHall conducted EMR analysis to find out the truth.
Client: Medical Malpractice Attorney
Categories: Digital Forensics, E-Discovery
Cell Phone Stalking
Cell phone forensic evidence in restraining order case
Our client was going through a divorce and had moved with her son to a friend’s house, where she was certain that her husband did not know her location. However, during this time she was served divorce papers at the address by her husband’s attorney. Our client was shocked and shaken that her husband knew her whereabouts, and as a result requested a restraining order from the courts. She asked ArcherHall to search for digital evidence pertaining to the alleged stalking.
Client: Party to Family Law Case
Categories: Digital Forensics, Data Breach
Anti-Forensics
Investigating attempts to hide IP theft using anti-forensic software
Our client asked us to investigate a suspected theft of IP. Two employees had recently left the company for competitors and were suspected of misappropriating intellectual property and proprietary information. ArcherHall was given their laptops to search for unusual activity and build evidence of the IP theft, including file transfers to USB, files sent to personal email addresses, correspondence with rival companies, and mass deletion of files.
Client: Global Market Research Firm
Categories: Digital Forensics
Digging for Lost Emails
A creative solution to a challenging email extraction
Our client required access to copies of emails recorded on their company email journaling system to use as evidence for their defense in court. Due to technical difficulties with the system, extracting the information needed was becoming a long and arduous procedure. The judge’s concerns about delays in the discovery process mounted extra pressure on the attorneys, who were told to provide the digital evidence as quickly as possible.
Client: Public School District
Categories: Digital Forensics, E-Discovery
Malpractice at a Surgical Facility
Forensic examination of Electronic Medical Records
Our client was the plaintiff in a case seeking to prove that a surgical facility was not following proper medical protocol and performing surgeries without the proper pre-surgery health assessment. Allegations were made that the facility was falsifying medical records by overwriting the pre-surgery assessment digital signatures with the post-surgery medical record signature. In effect, this data replacement was erasing the evidence of the malpractice.
Client: Malpractice Victim
Categories: Digital Forensics, E-Discovery
Falsely Accused
A software company is accused of destroying their client’s data
Our client was a software company accused of selling faulty software. The software package purchased by the plaintiff was designed for use in a specific retail industry. According to the plaintiff’s complaint, the defendant’s software destroyed the data stored by the plaintiff, causing the business to sustain significant losses. The plaintiff refused to settle with the defendant but insisted that the case go to trial.
Client: Software Company
Categories: Digital Forensics
Digital Theft of IP
A cover-up is uncovered
Our client was a corporation investigating suspected theft of intellectual property by a former employee. The employee had left for a competitor, allegedly taking proprietary customer and technical data with him. The client suspected the defendant had attempted to cover his tracks by wiping his computer. The case ultimately involved multiple computers, external media, and mobile devices.
Key Success: Overcame the defendant’s efforts to hide and destroy evidence and won recognition from the judge for our work.
Client: Corporation
Categories: Digital Forensics, Data Breach
Explicit Content in School
An innocent teacher is exonerated
We were retained to investigate accusations that a special education teacher had been browsing the internet for adult content, including suspected child pornography. The school’s web traffic monitoring software had flagged a site the teacher had visited. Given the severity of the accusations, the school executives wanted to verify with certainty that the allegations were accurate.
From the Attorney: “I wanted you to know how much the [client] and I appreciated the work done by you and your team to resolve the mystery involving [the teacher]’s computer. The fact that you didn’t simply accept the easy explanation — that he must have searched for pornography and hid it so well that you couldn’t find it — and doggedly pursued the truth, avoided what might have been a serious miscarriage of justice that could have resulted in [the teacher] losing his job, his reputation and maybe his freedom. You should also know that being under this cloud of suspicion has overwhelmed [the teacher] and, while he will take some time to recover, he is extremely relieved to have been exonerated. And the professionalism and expertise of you and your co-workers relieved [client] of the horrible burden of mistakenly taking action against an innocent man.”
Client: School District
Categories: Digital Forensics, Data Breach
Inside Job
Investigating an internal data breach
Our client, an industry-leading manufacturer of fuel cells, was involved in a large lawsuit related to the termination of an employee. The client believed an accomplice in IT, who had previously received advanced technical training in the military, was helping the ex-employee steal data from the company.
Key Success: Rapidly determined the method, intent, and suspected perpetrator of the network breach.
Client: Large Corporation
Categories: Digital Forensics, Data Breach
E-Discovery
Client and Sales Data in Employment Dispute
Deep retrieval of data from inactive CRM
Our client was being sued by one of their former employees. To defend against the claim, they needed to retrieve data from the oldest available backup of their inactive customer relationship management (CRM) system. The company required data from the backup to demonstrate the employee’s performance as evidenced by his activity within the system.
Client: Corporation
Categories: Digital Forensics, E-Discovery
Malpractice Leads to Patient’s Death
Electronic Medical Record analysis uncovers records tampering
Our client, an attorney specializing in medical malpractice, hired ArcherHall for our experience analyzing electronic medical records (EMR) and presenting accurate timelines of patient care. The attorney was dealing with a case involving a physician who was accused of medical malpractice after their patient’s condition worsened significantly under their follow-up care. The attorney requested a copy of the patient’s electronic medical record from the physician, who presented him with paper documents. The attorney noticed inconsistencies in the dates of the records and suspected fabrication or tampering had occurred. ArcherHall conducted EMR analysis to find out the truth.
Client: Medical Malpractice Attorney
Categories: Digital Forensics, E-Discovery
Digging for Lost Emails
A creative solution to a challenging email extraction
Our client required access to copies of emails recorded on their company email journaling system to use as evidence for their defense in court. Due to technical difficulties with the system, extracting the information needed was becoming a long and arduous procedure. The judge’s concerns about delays in the discovery process mounted extra pressure on the attorneys, who were told to provide the digital evidence as quickly as possible.
Client: Public School District
Categories: Digital Forensics, E-Discovery
Malpractice at a Surgical Facility
Forensic examination of Electronic Medical Records
Our client was the plaintiff in a case seeking to prove that a surgical facility was not following proper medical protocol and performing surgeries without the proper pre-surgery health assessment. Allegations were made that the facility was falsifying medical records by overwriting the pre-surgery assessment digital signatures with the post-surgery medical record signature. In effect, this data replacement was erasing the evidence of the malpractice.
Client: Malpractice Victim
Categories: Digital Forensics, E-Discovery
E-Discovery in Environmental Litigation
A multi-year case goes to trial
Our client was a state agency involved in decades-long litigation regarding an even older environmental issue. The long history of the matter meant a substantial volume and variety of documents, with new relevant documents being generated every day. The agency had the foresight to involve ArcherHall as early as possible, allowing us to collect and process the complete set of documents, and giving us the full picture of the evidence related to the case.
Client: Government Agency
Categories: E-Discovery
Data Breach
Cell Phone Stalking
Cell phone forensic evidence in restraining order case
Our client was going through a divorce and had moved with her son to a friend’s house, where she was certain that her husband did not know her location. However, during this time she was served divorce papers at the address by her husband’s attorney. Our client was shocked and shaken that her husband knew her whereabouts, and as a result requested a restraining order from the courts. She asked ArcherHall to search for digital evidence pertaining to the alleged stalking.
Client: Party to Family Law Case
Categories: Digital Forensics, Data Breach
Anti-Forensics
Investigating attempts to hide IP theft using anti-forensic software
Our client asked us to investigate a suspected theft of IP. Two employees had recently left the company for competitors and were suspected of misappropriating intellectual property and proprietary information. ArcherHall was given their laptops to search for unusual activity and build evidence of the IP theft, including file transfers to USB, files sent to personal email addresses, correspondence with rival companies, and mass deletion of files.
Client: Global Market Research Firm
Categories: Digital Forensics
Digital Theft of IP
A cover-up is uncovered
Our client was a corporation investigating suspected theft of intellectual property by a former employee. The employee had left for a competitor, allegedly taking proprietary customer and technical data with him. The client suspected the defendant had attempted to cover his tracks by wiping his computer. The case ultimately involved multiple computers, external media, and mobile devices.
Key Success: Overcame the defendant’s efforts to hide and destroy evidence and won recognition from the judge for our work.
Client: Corporation
Categories: Digital Forensics, Data Breach
Explicit Content in School
An innocent teacher is exonerated
We were retained to investigate accusations that a special education teacher had been browsing the internet for adult content, including suspected child pornography. The school’s web traffic monitoring software had flagged a site the teacher had visited. Given the severity of the accusations, the school executives wanted to verify with certainty that the allegations were accurate.
From the Attorney: “I wanted you to know how much the [client] and I appreciated the work done by you and your team to resolve the mystery involving [the teacher]’s computer. The fact that you didn’t simply accept the easy explanation — that he must have searched for pornography and hid it so well that you couldn’t find it — and doggedly pursued the truth, avoided what might have been a serious miscarriage of justice that could have resulted in [the teacher] losing his job, his reputation and maybe his freedom. You should also know that being under this cloud of suspicion has overwhelmed [the teacher] and, while he will take some time to recover, he is extremely relieved to have been exonerated. And the professionalism and expertise of you and your co-workers relieved [client] of the horrible burden of mistakenly taking action against an innocent man.”
Client: School District
Categories: Digital Forensics, Data Breach
Inside Job
Investigating an internal data breach
Our client, an industry-leading manufacturer of fuel cells, was involved in a large lawsuit related to the termination of an employee. The client believed an accomplice in IT, who had previously received advanced technical training in the military, was helping the ex-employee steal data from the company.
Key Success: Rapidly determined the method, intent, and suspected perpetrator of the network breach.
Client: Large Corporation
Categories: Digital Forensics, Data Breach
Digital Forensics Services
Forensic Imaging
Create exact bit-for-bit copies of the data on a computer or other storage medium. Admissible in court and provably identical to the original.
Cell Phone Forensics
Imaging, recovery, and analysis of data from cell phones, tablets, and other mobile devices.
Data Recovery
Extract data from corrupted or damaged devices. Find and restore deleted files and messages.
Expert Evidence Analysis
Identify files, emails, or activity logs that are relevant to the case. Piece together subtle clues to provide a clear story.
Expert Testimony
Testify in court or deposition regarding the conclusions of evidence analysis, validity of data, and soundness of methodologies.
Theft of Trade Secrets
Investigate unauthorized copying, printing, or transfer of sensitive or valuable data.
E-Discovery Services
Data Collection
Collect local, network, or cloud data from multiple custodians at multiple locations.
Processing & Production
Exclude irrelevant data, capture text and metadata, and Bates label. Produce native files or TIFFs and load files for all popular systems.
Hosted Review
Access discovery documents from anywhere through our online review platform. Spend time on review, not document management.
Advanced Culling Techniques
Reduce discovery costs by excluding more non-relevant documents, especially for clients operating in big data environments.
Early Case Assessment
Find out what your data contains before you get too deep. Quickly view data by file type, timeline, or relationships between people.
Electronic Medical Records
Collection, processing, and analysis of Electronic Medical Records (EMR) and associated metadata.
Confused about digital forensics?
Read about common topics in plain language:
Data Breach Services
Data Breach Surveys
Evaluate your security measures, including penetration testing and wireless security assessments.
Incident Response
Rapid deployment to investigate a network breach. Quickly secure your network, shore up weaknesses, and collect evidence.
Remediation & Recovery
Restore computers and networks after disruptions such as malware, viruses, or ransomware.
Non-Network Data
Secure data that leaves your network, on mobile devices or on cloud services like Office 365, Exchange, Dropbox, and iCloud.
Payment Security
Investigate compromises of point of sale (POS) and credit card systems.
Security Awareness Training
Train employees and contractors to avoid human security exploits.
