Phase 1: Plan
This phase lays a solid foundation for IT Acceleration's forensic services by defining the protocols and strategies for on demand rapid response . The Plan phase provides a clear picture of the client's technical architecture, internal policies, people, devices, and potential issues. Often, there is a rush to collect data only to have to re-collect because of problems or omissions. We plan first, then execute, ensuring minimal disruption while managing costs.
Phase 2: Preserve
Preservation is the key to a successful engagement and evidence introduction in court. Data collected is securely stored until authorization is granted to review. Not only do we master preservation but we do it more efficiently and thoroughly than any other vendor. Depending on the size of the preservation requirement, our forensics experts can conduct all computer imaging on site at your location. This means your equipment remains at your facility at all times and is returned back to the user after imaging – typically 2 hours per device. Proper evidence preservation, back-up and logging ensures a firm foundation for evidentiary authentication and tracking. Our imaging is unmatched. FACT: two IT Acceleration analysts onsite can compile over 55 computer images in a 24 hour period with all chain-of-custody documentation completed. No other firm can make these claims. Call us and we'll tell you how we do it.
Phase 3: Analyze
Based on the requirements of the court order, subpoena, or Form 35, IT Acceleration performs its analysis and will gather the relevant data, deleted, active, or hosted. Additionally, we are prepared to investigate computer activity, websites, social networking sites, or any digital device capable of storing data. Aside from computers, we have analyzed video surveillance systems, cameras, thumb drives, CDs and DVDs, iPods, iPads, SANs, Virtual Machines, tapes, cell and smart phones, card key swipes, websites, Facebook, Myspace, POP3 email, GoogleDocs, Playstations, Xbox consoles -- the list continues to grow. For investigative cases, such as criminal defense or corporate investigations, you provide IT Acceleration with the necessary information about the people, equipment, and knowledge related to the dispute. IT Acceleration uses the information to conduct the most relevant investigative process and incident analysis.
Phase 4: Review
The production from the search terms is reviewed to ensure we are inclusive but not overly inclusive. This is the time to make changes before the entire collection is searched. An overly inclusive production can lead to unnecessary, excessive costs. At times, sampling makes sense to determine if there is a financial benefit to proceed, for example, a year's worth of backup tapes. Sampling two months may make more sense than completing 12 months if you determine the data collected from the sampling is not worth the financial burden.
Phase 5: Produce
Once the size of the data review is determined, a review method is selected. There are many options and a discussion is warranted to make sure all parties agree on the review tool and the delivery. Many law firms now have invested in tools such as iPRO, Summation, or Concordance; however, many do not have the capacity to host all the data anticipated in the case or the technical support in-house to manage a complex collection. We can help make this a seamless progression.
Phase 6: Expert Services
Whether the need is for expert reports, deposition support, or court testimony, IT Acceleration follows the case through completion. We have unmatched capabilities presenting very technical topics so that the court and jury can understand the evidence and methods used to acquire the evidence. Our testimony has been THE deciding factor in many cases.