When was the last time you hired a computer forensic examiner? Perhaps you never have, or perhaps it was such a mysterious experience, you were left unsure what you paid for.
Lets face it, not every examiner keeps you “in the loop” when it comes to explaining what was looked at, what was found and what you have been billed for. Not every engagement is successful in locating that which may be of use to you. For any number of reasons, the evidence may not exist.
You should expect your engagement to include a proper contract that spells out the various processes and costs involved. Every engagement should include two basic stages. The data capture and preservation stage and the analysis stage. Beyond that you may want to discuss and include any reporting required. For example, is this expected to be used in a court case? Will a verbal report of the findings be sufficient? The time spent to report findings verbally is significantly less than time spent documenting procedures and processes to be used in a court of law. And lets face it, time is money, your money.
Your engagement should specify regular contact and updates, in order that you know what has happened and what sort of hours has been billed to your account. That may mean a daily email explaining where the analysis is at, or a telephone conversation. These regular discussions won’t amount to much in terms of “billable” time and can give you the insight to keep control of your expenses and ask questions about the best approach. It may also let you know whether someone is actually working on your file, or if it has been set aside so that other client needs can be looked after. Some examiners have too much on their plate, and the “fast response” promised fails to materialize.
I was engaged by a law firm that had previously hired another local computer forensic company to look for some deleted material. They arrived promptly and imaged the drive in question. Some days later they arrived again and requested to image the drive again. Weeks later, no response was forthcoming and inquires were made with the contractor. The inquiries seemed to fall into the “bit bucket”. Only after sending notice that they had hired another contractor to do the work, did any response arrive. At no other time did anyone from the contracted agency contact this client. The result was more than an invoice to argue over. Much time was lost on what was an important and time sensitive matter.
In our experience, more contact between client and examiner is always better.
