Collection and Preservation

The first, least expensive and most important step ….

When you first suspect a data breach or any other cause of action resulting from digital information, the first and most important step is to collect and preserve the evidence. Our team of experts knows exactly how to unobtrusively preserve your evidence, and which techniques to deploy to cull down thousands or millions of data pieces to the key items that really matter to your case.

For employers who suspect digital foul play, the first and most important step is to preserve the evidence.  Make sure that the computer the former employee was using is not reissued to a new user as this could lead to all evidence being destroyed inadvertently.  Although IT departments are very qualified for technical tasks, you want to avoid having IT searching the machine first, because that complicates the task of computer forensic professionals and could again lead to the inadmissibility or even the destruction of critical evidence.  That same advice also applies to mobile and external devices—all of which should be accounted for and preserved.  One strategy you can use to retain and protect critical information is to simply remove the hard drive entirely when computers are returned.  Another option is to create a forensic image of the hard drive and maintain it for a specified amount of time or until you know it is not needed.  When cleaning out the workspace of the former employee be on the lookout for external devices that may have been used as well as passwords written on scraps of paper.

Don’t try and do your own cyber-sleuthing—call in the pros.  If there are altered or deleted files, for example, the moment you turn that computer on and start to use it, you risk having any evidence of what happened being overwritten.  Any court proceeding will have to account for the full timeline of events: when the employee in question was hired, fired, how long any suspicious activity may have been occurring, etc.  The last 4-6 weeks prior to departure is the period that encompasses the most questionable behavior.


  • We are an all in one document support company that assists you from the beginning to the end of your trial preparation.  Anything from copying, scanning, trial boards, data processing – we do it all plus some!

    Alex Gomez, Account Executive (Chicago)
  • We are an all in one litigation support company that handles all aspects of a lawsuit.  We usually begin with forensic collections and will provide support throughout the discovery process and also support any trial presentation or court reporting needs.

    Dave McIsaac, Senior Account Executive (Chicago)
  • I work for an all-in-one litigation support firm that handles complex issues ranging from forensic collection, hosted environments (with an agnostic approach that fits our client’s needs), electronic discovery, scanning, and copies/blow back, to our trial director team sitting in the hot seat, or creating demonstratives for our clients. I recognize right now isn't the ideal place to meet, but I'm often in your building multiple times a day working with your firm & would love the opportunity to formally meet with you to further introduce my company and to potentially see if there might be an opportunity for us to work together.  I promise to leave the boring sales pitch at the office and I won't take up more than 5 minutes of your time!

    Chad Heilig, Senior Account Executive (Chicago)