The role of the consulting expert often begins with the realization by a corporation that an employee who resigned, and is now working with a competing firm, may have taken sensitive company data. My first task as a consulting expert often is to evaluate and document early preservation and investigation efforts by a client’s internal staff, in order to properly interpret digital evidence later.
Whether it involves suspected employee data theft, a computer intrusion or other misconduct, it is rare for internal security, HR or legal departments to have not started their own investigation. Depending on the experience of the internal responders or IT staff, computer evidence will have been identified, perhaps preserved, and analyzed to some extent. The operational necessities for an organization to recover from internal or external misconduct will sometimes trump preserving evidence. Your outside expert will lend an experienced eye to initial investigation or preservation efforts and provide an independent assessment on the scope and effectiveness of those efforts.