Home | Business News | Browse by Publication | S | Security Management

The electronic witness. (Investigations).

Article Excerpt
IT WAS ANY COMPANY'S WORST-CASE SCENARIO. Richard, a high-level engineer with utilities company ABC Electric Inc. (all names have been fictionalized), suddenly resigned his job and, along with another engineer, went to work for a newly created company, a competitor of their former employer. A few months later, ABC Electric's executives noticed with some concern that the competitor was quickly gaining market share in their highly specialized field. ABC Electric began to suspect that its competitor's good fortune might be the result of more than just hard work and luck. Had Richard stolen proprietary trade secrets regarding sales, marketing, and other technical data and taken that information to his new company?

ABC ELECTRIC DECIDED to find out. It went to court, accusing Richard of stealing its proprietary information and using that knowledge to aid its competitor. The legal wrangling began, and Richard was required by court order to provide his work and home computers for review by computer forensic experts hired by ABC Electric. But before he relinquished his home computer, Richard met with his attorneys and asserted that the PC contained private, family-related material on the hard drive that he did not want accidentally viewed or distributed. The attorneys, perhaps not well-versed in computer forensics, explored the files on Richard's computer in an attempt to assess their client's concerns. Through this simple act, they unwittingly destroyed evidence that might have helped exonerate or convict their client.

Gathering e-vidence. Several weeks later, a computer forensic investigations firm (where the author is leader of Internet investigations) was retained to analyze the computers. The investigators' top priority was to preserve the evidence before they even began their investigation; however, they knew that when Richard's lawyers booted up his computer weeks earlier, the Windows-based operating system modified numerous file dates and times that could have indicated when files were last viewed by Richard--and thus destroyed potentially critical evidence. (Many cases involving computers--including...

View this article FREE - Now for a Limited Time, try Goliath Business News
Free for 3 Days!