Innovation Update

Forensically preserving electronic evidence during a lockdown

During the COVID-19 lockdowns, how did fraud examiners manage evidence collection? Learn from forensic technology industry experts about collecting custodian information and remote data preservation.

During the height of the COVID-19 pandemic, with extensive travel restrictions in place, a U.S. regulator subpoenaed Prospect Worldwide — a large global manufacturing company with offices in the U.S. and Latin America — to preserve company data related to an investigation. The scope of this data included company-owned computer hard drives, mobile phones, and corporate email and file-server data for more than two dozen company employees (aka “data custodians”) who possessed potentially relevant information. (The company name and case details have been changed for this column.)

A local, experienced forensic technology collection team typically would conduct this type of preservation work on-site. However, because of pandemic travel restrictions and social distancing orders, forensic investigators had to perform most of the required preservation activities remotely — often from their home offices. They worked with Prospect Worldwide’s IT department and retained outside counsel to apply creative and alternative methods, in cooperation with the data custodians, to facilitate remote connectivity to target data sources.


For full access to story, members may sign in here.

Not a member? Click here to Join Now. Or Click here to sign up for a FREE TRIAL.