When a business has to call for the services of a Computer Forensics Expert, CFE, people are as involved as the computers. Long before filing a lawsuit, you need to make some choices including how best to handle situations which may involve employees. Finding out from a competitor that your employees are accused of stealing proprietary information is bad. A visit by law enforcement regarding misconduct by employees is worse. Both are times when you need to carefully think about what your next course of action will be. Taking action as early in the process as possible will be cost-effective and help make sure that the correct data is saved and protected.

A first step would be to consult with your company’s attorney. Your lawyer may also be able to put you in touch with a computer forensics expert. Bringing the expert in during the very early part of an investigation doesn’t mean that an unlimited amount of money has to be spent. A initial window of opportunity can be used for determining which parts of the system are relevant and how to best preserve them. While deeper analysis and processing may come later, getting a snapshot of where everything stands in the beginning can provide you and your team with a good map to follow as the investigation unfolds. Having some direction in place will also save you some money.

If you and your business are the defendants in a case of computer fraud or the loss of confidential business information, then the forensics expert you hire becomes more important. One overlooked task of your expert is to have them interface with the plaintiff’s computer forensics expert. Together, they can lay out a course of investigation which may allow for being on site at the same time and, with the requirement that the prosecution provide you with the evidence, you may also save some extra money with the two working together.

Regardless if your expert is able to work with the other side’s expert, you need to work out and negotiate an efficient and effective protocol for inspection. Another consideration such as saving mobile data or dealing with encryption challenges are two situations with which your expert should help you deal with during the pre-litigation phase or later in discovery projects.

Invest some of your time in talking with IT administrators and custodians to ensure you are knowledgeable of how well legal hold instructions are being followed. Your expert can provide a trained eye to supervise non-lawyers which are conducting discovery tasks. Monitoring the legal hold process, documenting systems and tracking data sources will give you more tools with which to respond if future attacks are made on your preservation steps.

Your CFE should be involved in the entire process. Forensic analysis that is performed with the work being done by your team may help lead to success. Often, discovery and analysis are seen as separate steps in the process. Your team has the best grasp of issues as they work through your system, so it is important that your expert also work closely with your team members.

A main key to staying within budget during the stressful investigation and subsequent actions is to work closely with your CFE at each stage and make sure you get the most effective analysis without unnecessarily running up the bill.