Computer Forensics and Investigations

Computer Forensics is in our DNA and is a particular specialty of KrolLDiscovery. For many of our experts, it’s been their career and life-long passion and it shows in our work.  We are “tool agnostic,” meaning we know how to use and have licenses for all tools – EnCase, FTK, Paraben, etc, – and use what tools fits the matter best.  Our engineers are skilled in all types of computing systems – servers, mainframes, cloud computing, PCs, and laptops, across all operating systems, including Windows, UNIX and MAC. Our expertise extends to cell phones, tablets, individual email and across all corporate email systems, including Microsoft Exchange, Lotus Notes and Groupwise.

Our actions speak louder than words

Our analysts have years of experience investigating real cases and obtaining real results in both civil and criminal contexts. Our analysts are recognized experts in the field. They have been accepted hundreds of times as experts in federal and state court, and have trained others to become experts. Few other companies can come close to matching that record.

Our personnel are experts because they not only can perform complicated forensic acquisitions and analysis, but they can also explain at the basic, scientific level what they are doing and why. All too many other advertised “experts” have been trained simply to use forensic software, ignoring the “whys” or “hows” that our experts intimately understand. Equally important is that our experts have years of experience as investigators. They have investigated innumerable computer-based crimes, obtained indictments and made arrests, and successfully prosecuted offenders in federal and state court. They have done the same in the civil arena, working with counsel to gather, analyze, understand and present evidence to judges and juries in civil matters, with highly favorable results.

Don’t just take our word for it.  Here are real-life scenarios where KrolLDiscovery’s computer forensic experts made a difference for our customers:

  • Stealing the Secret Sauce.  In a multi-million dollar intellectual property matter, we searched computers used by departed employees to uncover evidence that they had copied and sent patented design information to another company.
  • Not so fast. When a high-level employee in a high-profile intellectual property matter left for a rival, we uncovered evidence that led the court to enjoin the employee from working for that rival; the matter was considered one of the most significant employment cases of 2010.
  • Employee of the Month.  A company suspected an employee of theft. Our examination of the company’s computers uncovered evidence with which the employer confronted the employee, who admitted the wrongdoing and agreed to termination.
  • The Smoking Gun. A law firm representing a company whose former, high-level employee had left suddenly for a rival company engaged us to determine whether we could recover evidence on the former employee’s work computer of attempts to break his covenants of non-competition and non-solicitation of clients. Though a new employee was using the computer, KrolLDiscovery was able to recover irrefutable evidence of malfeasance by the former employee, including “smoking gun” evidence that he had visited the website “” What would have been long, drawn-out litigation turned into a quick and total victory for the client, when the employee resigned from his new company and all of the client’s customers returned.
  • Breaking the Bad News.  Several former employees of one company had formed a new company and were being sued for breaking numerous contractual covenants. One of the former employees maintained to our client that examination of his computer would prove that he had deleted all materials he was accused of taking. We examined that computer and discovered evidence contrary to the former employee’s claims of innocence. While this was not the result that our client had hoped for, it showed the strength of the plaintiff’s case and allowed our client to approach the issue of settlement from an informed position.
  • Refuting Spoliation Claims. In a federal matter between two notable software suppliers, one party claimed that a spoliation led to the loss of thousands of potentially responsive emails. Our analysts were able to recover all files and demonstrate that no data had been lost; the court dismissed the spoliation claim. Following verdict, both parties appealed all of the rulings and judgments adverse to them, except for the dismissal of the spoliation claim.

What can we search for?

KrolLDiscovery’s computer forensic experts can search for anything and everything, ranging from evidence of usage patterns to listings of deleted files.  Computers, cell phones and other devices can be used for practically anything – as such, our analysis can look for practically anything and perform a search that is as detailed or as cursory as you require.

While the list of patterns we can search for is limitless, common requests for analysis often include:

  • Deleted File Recovery
  • Internet Search & Browsing History
  • Registry analysis (the Registry keeps a record of computer activity, including what external devices, such as “thumb” or “flash” drives, were connected to the computer and when.)
  • Last accessed, modified, or created dates of files
  • Web Mail recovery
  • Evidence of cloud-based storage
  • Evidence of wiping utilities or evidence/file destruction
  • Validate the findings of other computer examiners
  • Password cracking
  • Chat, text, and other on-demand/mobile communication history

No two analysis projects are alike

We recognize that no two investigations are alike.  Some investigations require us to find every bit and byte from the trail of digital breadcrumbs, while others simply want a few emails to show that “Person A” knew “Person B.”  It is sometimes necessary to uncover all “questionable” content, while other times only a representative sampling or a list of similar files is needed.  Regardless of the situation, we embrace this diversity and approach every investigation with a “ground up” approach. Our team of legal and computer forensic experts will help identify the specific fact patterns in question and build a custom workflow, comprised of forensically-sound best practices and universally accepted methods, to help uncover what can be uncovered in the quickest, most cost effective, and, above all else, the most defensible manner possible.

What can KrolLDiscovery do for you?

Our computer forensic experts have achieved real results for our clients, including complying efficiently and successfully with overwhelming discovery orders to saving a company from a problem employee. Let us show you what KrolLDiscovery can do for you.

For more information,
please contact
Robert Hunter<br>
Robert Hunter
Vice President, Operations
Email | 215-900-9274
Latest News   RSS

KrolLDiscovery ranked at number 427 on Deloitte’s 2017 Technology Fast 500™ list

KrolLDiscovery, included in the list for the sixth consecutive year, attributes its rank to a sharp…

KrolLDiscovery opens new ISO 27001-certified data center in Ireland

KrolLDiscovery’s new data center commenced operations in Ireland on November 1 McLean, Va. – November 8,…

KrolLDiscovery and ZL Technologies Celebrate 10 Years of Partnership in Compliance and End-to-End Ediscovery

Enterprise solutions from KrolLDiscovery help organizations manage unstructured data for ediscovery, compliance, records management and knowledge…

all news »
Share this page!